"""
Auth-field normalizers — applied to the raw incoming message *before* the
auth check runs.  Protocol fields (pubkey, sig, …) are still present here.

Add one entry per breaking auth-field change:
    ("X.Y.Z", transformer_fn)

Entries must stay in ascending version order.
"""
from __future__ import annotations
from typing import Callable
from browser_cli.version_manager import parse_version


# ── v0.9.3 ────────────────────────────────────────────────────────────────────

def _auth_0_9_3(msg: dict) -> dict:
    """pubkey validation tightened to lowercase hex; normalize for older clients."""
    changed: dict = {}
    pk = msg.get("pubkey")
    if isinstance(pk, str) and pk:
        changed["pubkey"] = pk.lower()
    if msg.get("command") == "browser-cli.auth.trust":
        args = msg.get("args") or {}
        trust_pk = args.get("pubkey")
        if isinstance(trust_pk, str) and trust_pk:
            changed["args"] = {**args, "pubkey": trust_pk.lower()}
    return {**msg, **changed} if changed else msg


# ── registry ──────────────────────────────────────────────────────────────────

_AUTH_COMPAT: list[tuple[str, Callable[[dict], dict]]] = [
    ("0.9.3", _auth_0_9_3),
]


def adapt_auth(msg: dict, client_version: str) -> dict:
    """Apply all auth normalizers needed to bring msg up to the current format."""
    cv = parse_version(client_version)
    for version, fn in _AUTH_COMPAT:
        if cv < parse_version(version):
            msg = fn(msg)
    return msg