"""IdentityVerifier registry (§2.3) — one dispatcher keyed by method, so ingress selects an adapter by the
declared `identity_method` without knowing concrete types. Unknown method → `None` (the router then treats a
supplied-but-unverifiable signature as a REJECT, fail-closed)."""

from __future__ import annotations

from typing import Optional

from cl.identity.did_web import DidResolver, DidWebVerifier
from cl.identity.signatures import Ed25519Verifier, Es256Verifier
from cl.identity.stubs import BaseVerifier, EudiVerifier, GoogleVerifier
from cl.interfaces.identity import IdentityVerifier


class VerifierRegistry:
    def __init__(self) -> None:
        self._by_method: dict = {}

    def register(self, verifier: IdentityVerifier) -> "VerifierRegistry":
        self._by_method[verifier.method()] = verifier
        return self

    def for_method(self, method: Optional[str]) -> Optional[IdentityVerifier]:
        if method is None:
            return None
        return self._by_method.get(method)


def default_registry(did_resolver: Optional[DidResolver] = None) -> VerifierRegistry:
    """The core verifiers (Ed25519, ES256) + did:web when a resolver is supplied + the not-yet-implemented
    stubs (Base/Google/EUDI) so their methods are recognized but fail-closed."""
    reg = VerifierRegistry()
    reg.register(Ed25519Verifier())
    reg.register(Es256Verifier())
    if did_resolver is not None:
        reg.register(DidWebVerifier(did_resolver))
    reg.register(BaseVerifier())
    reg.register(GoogleVerifier())
    reg.register(EudiVerifier())
    return reg
