"""Provider OAuth grant declarations.

The catalog remains the source of action scopes; this module only describes the
provider-level consent families used by the dashboard authorization flow.
"""

PREFIX = "https://www.googleapis.com/auth/"
FAMILY_SCOPES = {
    "identity": ("openid", "email", "profile"),
    "calendar": (PREFIX + "calendar.events", PREFIX + "calendar.readonly"),
    "drive": (PREFIX + "drive.file",),
    "docs": (PREFIX + "documents",),
    "sheets": (PREFIX + "spreadsheets",),
    "analytics": (PREFIX + "analytics.readonly",),
    "gtm": (PREFIX + "tagmanager.readonly",),
    "ads": (PREFIX + "adwords",),
}
# Measurement Protocol (GA4) and the GTM container snippet do not use these
# OAuth grants. Cloud sends measurement_id + api_secret, or injects a container
# ID. There is no Analytics Data API or Tag Manager API call to authorize.
CONNECTOR_FAMILIES = {
    "google_calendar": "calendar",
    "google_docs": "docs",
    "google_sheets": "sheets",
    "google_ads": "ads",
}

HUBSPOT_FAMILY_SCOPES = {
    "crm": (
        "crm.objects.contacts.read",
        "crm.objects.contacts.write",
        "crm.objects.companies.read",
        "crm.objects.companies.write",
        "crm.objects.deals.read",
        "crm.objects.deals.write",
        "crm.schemas.contacts.read",
        "crm.schemas.companies.read",
        "crm.schemas.deals.read",
    ),
}
HUBSPOT_CONNECTOR_FAMILIES = {"hubspot": "crm"}
SALESFORCE_FAMILY_SCOPES = {
    "crm": ("api", "refresh_token", "offline_access", "openid", "profile", "email"),
}
SALESFORCE_CONNECTOR_FAMILIES = {"salesforce": "crm"}
X_ADS_FAMILY_SCOPES = {
    "ads": ("tweet.read", "users.read", "ads.read", "ads.write", "offline.access")
}
X_ADS_CONNECTOR_FAMILIES = {"x_ads": "ads"}
MICROSOFT_ADS_FAMILY_SCOPES = {
    "ads": (
        "https://ads.microsoft.com/msads.manage",
        "offline_access",
        "openid",
        "profile",
        "email",
    )
}
MICROSOFT_ADS_CONNECTOR_FAMILIES = {"microsoft_ads": "ads"}


def normalize_scopes(scopes):
    aliases = {PREFIX + "userinfo.email": "email", PREFIX + "userinfo.profile": "profile"}
    return sorted({aliases.get(s, s) for s in scopes})


def authorization_manifest(connector_key):
    provider = "google"
    family = CONNECTOR_FAMILIES.get(connector_key)
    if not family:
        provider = "hubspot"
        family = HUBSPOT_CONNECTOR_FAMILIES.get(connector_key)
    if not family:
        provider = "salesforce"
        family = SALESFORCE_CONNECTOR_FAMILIES.get(connector_key)
    if not family:
        provider = "x_ads"
        family = X_ADS_CONNECTOR_FAMILIES.get(connector_key)
    if not family:
        provider = "microsoft_ads"
        family = MICROSOFT_ADS_CONNECTOR_FAMILIES.get(connector_key)
    if not family:
        return None
    return {
        "provider": provider,
        "grant_family": family,
        "trigger": "on_use",
        "actor": "project",
        "scopes": list({
            "google": FAMILY_SCOPES,
            "hubspot": HUBSPOT_FAMILY_SCOPES,
            "salesforce": SALESFORCE_FAMILY_SCOPES,
            "x_ads": X_ADS_FAMILY_SCOPES,
            "microsoft_ads": MICROSOFT_ADS_FAMILY_SCOPES,
        }[provider][family]),
    }