import mizan  # mizan-sdk: verify_token is offline when keys are given

HEADER = "Mizan-Verdict"   # value: one mzv1 token. "X-Mizan-Verdict" is read too (earlier spelling).


def header_verdict_ok(headers, payee, keys, rule, now=None):
    """headers: the request headers (any case). payee: your own identifier as MIZAN knows it. rule: the rule hash you
    require. keys: your pinned {kid: base64 Ed25519}. Offline. -> (ok, code)"""
    h = {str(k).lower(): str(v) for k, v in (headers or {}).items()}
    token = (h.get("mizan-verdict") or h.get("x-mizan-verdict") or "").strip()
    if not token:
        return False, "no_verdict"
    if "," in token or " " in token:
        return False, "malformed"   # exactly one token per header
    r = mizan.verify_token(token, keys, payee=payee, rule=rule, now=now)
    if not r["ok"]:
        return False, r["code"]
    if (r["claims"].get("bound_to") or {}).get("rule") != rule:
        return False, "rule_mismatch"
    return (True, "valid") if r["claims"].get("decision") == "ALLOW" else (False, "refused")