"""Goal-oriented execution authorization — skip duplicate confirmations when plan-bound.

After goal accepted, plan approved, permissions granted, profile/session allows,
and step is NOT in Stop Zone → execute without per-step modal confirmation.
"""

from __future__ import annotations

from typing import Any

from .action_session_policy import (
    WEB_PLAN_BOUND_AUTO_COMMAND_TYPES,
    command_always_requires_confirm,
    permission_preset_allows_risk_skip,
    plan_step_matches_session,
    session_confirmation_allows_skip,
)
from .production_policy import is_publish_submit_action

# In-scope command types for goal/plan-bound autonomous execution (beyond web-post flow).
GOAL_AUTHORIZED_AUTO_COMMAND_TYPES = frozenset(
    WEB_PLAN_BOUND_AUTO_COMMAND_TYPES
    | {
        "open_folder",
        "read_file_in_workspace",
        "write_file_in_workspace",
        "list_files_in_folder",
        "application_launch",
        "open_document_edit",
        "web_fetch_bounded",
        "summarize_content",
        "generate_content",
        "insert_exact_text",
        "verify_workspace_file",
        "mouse_move_relative",
        "open_url",
        "describe_active_window",
    }
)

# Presets that may run full in-plan autonomy (assistant = full profile in UI).
GOAL_AUTONOMOUS_PROFILES = frozenset({"standard", "full", "expert"})


def is_goal_authorized_session(
    session_scope: dict[str, Any],
    *,
    trust_state: str = "",
    permission_preset: str = "",
) -> bool:
    if str(trust_state or "").strip().lower() != "trusted":
        return False
    if not str(session_scope.get("bound_to_plan_id") or "").strip():
        return False
    preset = str(permission_preset or session_scope.get("permission_preset") or "").strip().lower()
    return preset in GOAL_AUTONOMOUS_PROFILES


def goal_authorization_skip_confirmation(
    *,
    command_type: str,
    payload: dict[str, Any] | None,
    session_scope: dict[str, Any],
    trust_state: str,
    confirmation_mode: str,
    plan_bound: bool,
    risk_level: str,
    in_session_scope: bool,
) -> bool:
    """True when an authorized plan-bound step may skip per-step confirmation."""
    if command_always_requires_confirm(command_type, payload):
        return False
    if is_publish_submit_action(command_type, payload):
        return False
    if not plan_bound:
        return False
    if not in_session_scope:
        return False

    ctype = str(command_type or "").strip().lower()
    if ctype not in GOAL_AUTHORIZED_AUTO_COMMAND_TYPES:
        return False

    step_plan_id = str((payload or {}).get("plan_id") or "").strip()
    if not plan_step_matches_session(session_scope, plan_id=step_plan_id):
        return False

    if not is_goal_authorized_session(
        session_scope,
        trust_state=trust_state,
    ):
        return False

    permission_preset = str(session_scope.get("permission_preset") or "standard").strip().lower()
    if not permission_preset_allows_risk_skip(
        permission_preset,
        risk_level=risk_level,
        command_type=ctype,
        plan_bound=True,
    ):
        return False

    return session_confirmation_allows_skip(confirmation_mode, plan_bound=True)
