"""capabilities 白名单 — design §11 · D18 owner 客户端。"""

from __future__ import annotations

TENANT_CLIENT_LOCAL_CAPABILITIES: list[str] = [
    "chat.full",
    "memory.local",
    "vault.local",
    "wiki.local",
    "virtual_persona.local",
    "mcp.local",
    "llm.single_key",
    "llm.platforms:siliconflow,deepseek,custom",
    "llm.brain_primary_only",
    "llm.module_optional",
    "skills.inject.passive",
    "settings.tenant_config_l1",
    "auth.login_domain_username",
    "chat.offline_without_nas",
    "tenant.push.upstream",
    "client.local.agent",  # D21 · Chat/MCP/VP 本地
]

# 租户 NAS control：禁止 Bearer api_token
TENANT_NAS_FORBIDDEN: list[str] = [
    "bearer.api_token",
]

# pinn 客户端（含公网）· 确认主人后 · 可上云 · 无运维页
OWNER_CLIENT_REMOTE_CAPABILITIES: list[str] = [
    *TENANT_CLIENT_LOCAL_CAPABILITIES,
    "cloud.pinn.upload",
    "memory.cloud.upload",
    "storage.l1.pinn",
    "bearer.api_token.nas",  # D21 · NAS control API 须 Bearer
]

OWNER_DOCKER_INTRANET_CAPABILITIES: list[str] = [
    *OWNER_CLIENT_REMOTE_CAPABILITIES,
    "admin.users.*",
    "admin.users.fetch_policy",
    "admin.users.trigger_fetch",
    "tenant_auth.login_enabled",
    "core.*",
    "tier.*",
    "cloud.pinn",
    "worker.nas",
    "skill.edit",
    "skill.distill",
    "storage.l2.*",
    "agent.fetch.host_initiated",
]

# 向后兼容别名
OWNER_DOCKER_FULL_CAPABILITIES = OWNER_DOCKER_INTRANET_CAPABILITIES


def capabilities_for_role(role: str) -> list[str]:
    return capabilities_for_login(role)


def capabilities_for_login(
    role: str,
    *,
    desktop_agent: bool = False,
    intranet_console: bool = False,
) -> list[str]:
    if role == "owner":
        if intranet_console and not desktop_agent:
            return list(OWNER_DOCKER_INTRANET_CAPABILITIES)
        return list(OWNER_CLIENT_REMOTE_CAPABILITIES)
    return list(TENANT_CLIENT_LOCAL_CAPABILITIES)
