
    j                       d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl	m
Z
mZ ddlmZmZmZmZ  G d d	e      Z ed
d
       G d d             Z G d de      Z	 	 	 	 	 	 	 	 ddZ	 	 	 	 	 	 	 	 ddZ	 	 	 	 	 	 	 	 ddZy)zBStrict activation policy for bounded-pilot token-rotation waivers.    )annotations)Mapping)	dataclass)Path)ClassVarLiteral)	BaseModel
ConfigDictValidationErrorfield_validatorc                      e Zd ZdZy)TokenRotationPolicyErrorz>The activation checklist has no valid token-rotation decision.N)__name__
__module____qualname____doc__     }/home/cube/projects/richard/.worktrees/nutricoach-v140-impl/dualcoach/profile/checkin_cli/activation_token_rotation_policy.pyr   r      s    Hr   r   T)frozenslotsc                  :    e Zd ZU dZded<   ded<   ded<   ded<   y)	ActivationChecklistBindingsz;Authorities that a bounded-pilot waiver must match exactly.strcustomer_keyr   profile_root	data_rootregistry_pathN)r   r   r   r   __annotations__r   r   r   r   r      s    EOr   r   c                      e Zd ZU dZ eddd      Zded<   ded<   d	ed
<   ded<   ded<   ded<   ded<    eddd      edd              Z	y)TokenRotationWaiverz:Exact owner risk acceptance when rotation is not required.forbidT)extrar   strictzClassVar[ConfigDict]model_configzLiteral['not_required']statusz+Literal['existing_token_no_known_exposure']reasonzLiteral['bounded_pilot']scopezLiteral['owner_operator']approved_byzLiteral[True]approvedrisk_acknowledgedbefore)modec                $    |durt        d      |S )NTz+waiver acknowledgement must be exactly true)
ValueError)clsvalues     r   require_exact_truez&TokenRotationWaiver.require_exact_true)   s     JKKr   N)r1   objectreturnr3   )
r   r   r   r   r
   r%   r   r   classmethodr2   r   r   r   r!   r!      si    D)3tD*L&  $#77##**$$Z!48D  Er   r!   c                   | j                  d      }|du ry|durt        d      | j                  d      }	 t        j                  |      }t        |d|j                         t        |d	|j                         t        |d
|j                         t        |d|j                         y# t        $ r}t        d      |d}~ww xY w)zCAccept exact legacy rotation or an exact, fully bound pilot waiver.token_rotatedTNFz9token_rotated must be exactly true or false with a waivertoken_rotation_waiverz token rotation waiver is invalidr   r   r   r   )getr   r!   model_validater   _require_bindingr   _require_path_bindingr   r   r   )evidencepayloadbindingsr7   waiver_excs          r   validate_token_rotation_policyrC   1   s     LL1ME!&G
 	
 \\12FT..v6 Wnh.C.CD'>83H3HI';0B0BC'?H4J4JK  T&'IJPSSTs   B* *	C3B??Cc                p    | j                  |      }t        |      t        us||k7  rt        d| d      y )Ntoken rotation waiver  binding is invalid)r9   typer   r   )r>   keyexpectedr1   s       r   r;   r;   K   sD    
 KKEE{#(!2&$SE)<=
 	
 "3r   c                   | j                  |      }t        |      t        urt        d| d      	 t	        |      j                         |j                         k(  }|st        d| d      y # t        t        t        f$ r d}Y *w xY w)NrE   rF   F)	r9   rG   r   r   r   resolveOSErrorRuntimeErrorr/   )r>   rH   rI   r1   matchess        r   r<   r<   W   s    
 KKEE{#&$SE)<=
 	
u+%%'8+;+;+== &$SE)<=
 	
  \:. s   *A/ /BBN)r=   Mapping[str, object]r>   rO   r?   r   r4   None)r>   rO   rH   r   rI   r   r4   rP   )r>   rO   rH   r   rI   r   r4   rP   )r   
__future__r   collections.abcr   dataclassesr   pathlibr   typingr   r   pydanticr	   r
   r   r   r/   r   r   r!   rC   r;   r<   r   r   r   <module>rW      s    H " # !  $ L LIz I $d#  $) ,L"L!L *L 
	L4	
!	
		
 	
 
		

!
	
 
 
	
r   