"""Persona labels and role validation against GET /api/v1/auth/me."""

from __future__ import annotations

# Staff
ADMIN_OPERATOR = "admin_operator"
AGENT_HANDLER = "agent_handler"

# Portal customers (company_user flavours)
END_USER = "end_user"
TECHNICAL_USER = "technical_user"
# Backward-compatible alias for older manifests
SUPPORT_SEEKER = "support_seeker"

# Channel actors (no JWT login)
EMAIL_REPORTER = "email_reporter"
LANDING_VISITOR = "landing_visitor"

ALL_PERSONAS = (
    ADMIN_OPERATOR,
    AGENT_HANDLER,
    END_USER,
    TECHNICAL_USER,
    SUPPORT_SEEKER,
    EMAIL_REPORTER,
    LANDING_VISITOR,
)

CHANNEL_PERSONAS = frozenset({EMAIL_REPORTER, LANDING_VISITOR})
STAFF_PERSONAS = frozenset({ADMIN_OPERATOR, AGENT_HANDLER})
PORTAL_PERSONAS = frozenset({END_USER, TECHNICAL_USER, SUPPORT_SEEKER})


def requires_login(persona: str) -> bool:
    """Channel actors call public/webhook endpoints without Bearer auth."""
    return persona not in CHANNEL_PERSONAS


def persona_matches_role(persona: str, role: str) -> bool:
    if persona == ADMIN_OPERATOR:
        return role == "admin"
    if persona == AGENT_HANDLER:
        return role in ("admin", "user")
    if persona in PORTAL_PERSONAS:
        return role == "company_user"
    if persona in CHANNEL_PERSONAS:
        return True
    return False


def validate_persona_declared(persona: str) -> None:
    if persona not in ALL_PERSONAS:
        raise ValueError(f"unknown persona: {persona!r}; expected one of {', '.join(ALL_PERSONAS)}")