import mizan  # mizan-sdk: verify_token is offline when keys are given

EXTENSION = {"name": "market.mizan.verdict", "extends": ["$.CheckoutSessionCompleteRequest.mizan_verdict"],
             "schema": "https://mizan.market/verdict/acp-extension.schema.json", "spec": "https://mizan.market/verdict/#carriage"}


def acp_verdict_ok(complete_request, merchant_id, keys, rule, now=None):
    """complete_request: the ACP CheckoutSessionCompleteRequest the agent sent with the extension active
    ({"mizan_verdict": {"token", "kid"}}), or a DelegatePaymentRequest carrying metadata.mizan_verdict (a string).
    merchant_id: your own identifier as MIZAN knows it. rule: the rule hash you require. Offline. -> (ok, code)"""
    req = complete_request or {}
    m = req.get("mizan_verdict") or {}
    token = m.get("token") or (req.get("metadata") or {}).get("mizan_verdict") or ""
    if not token:
        return False, "no_verdict"
    r = mizan.verify_token(token, keys, payee=merchant_id, rule=rule, now=now)
    if not r["ok"]:
        return False, r["code"]
    if m.get("kid") and m["kid"] != r["claims"]["kid"]:
        return False, "kid_mismatch"
    if (r["claims"].get("bound_to") or {}).get("rule") != rule:
        return False, "rule_mismatch"
    return (True, "valid") if r["claims"].get("decision") == "ALLOW" else (False, "refused")