"""Server-owned enrollment profiles and bounded runtime environment contracts."""

from __future__ import annotations

from typing import Any

PROFILE_VERSION = "enrollment-profile/v1"

PROFILES: dict[str, dict[str, Any]] = {
    "internal-webapp": {
        "public": True,
        "authentication": "none",
        "runtimeEnvironmentKeys": ("APPOPS_PUBLIC_URL",),
        "requiresNpm": True,
        "requiresOidc": False,
    },
    "internal-webapp-oidc": {
        "public": True,
        "authentication": "native-oidc",
        "runtimeEnvironmentKeys": (
            "APPOPS_PUBLIC_URL",
            "OIDC_CLIENT_ID",
            "OIDC_CLIENT_SECRET",
            "OIDC_ISSUER",
            "OIDC_ROLE_CLAIM",
        ),
        "requiresNpm": True,
        "requiresOidc": True,
    },
    "internal-service": {
        "public": False,
        "authentication": "none",
        "runtimeEnvironmentKeys": (),
        "requiresNpm": False,
        "requiresOidc": False,
    },
    "repopulse-authenticated": {
        "public": True,
        "authentication": "npm-access-list+maintenance-token",
        "runtimeEnvironmentKeys": (
            "REPOPULSE_GITEA_URL",
            "REPOPULSE_GITEA_TOKEN",
            "REPOPULSE_MAINTENANCE_TOKEN",
        ),
        "requiresNpm": True,
        "requiresOidc": False,
    },
}


def profile_contract(name: str) -> dict[str, Any] | None:
    profile = PROFILES.get(name)
    return dict(profile) if profile else None


def profile_summary(name: str) -> dict[str, Any] | None:
    profile = profile_contract(name)
    if profile is None:
        return None
    return {"name": name, "version": PROFILE_VERSION, **profile}