from __future__ import annotations

MASK = "***"
SECRET_KEYS = {"password", "token", "refresh_token", "access_token", "auth_token", "key", "secret"}

AUTH_CONFIG_ALLOWED_KEYS = {
    "none": set(),
    "bearer": {"token", "refresh_token", "expires_in", "token_expires_at", "refresh_path"},
    "new_api_token": {"token", "user_id", "new_api_user", "provider"},
    "nox_token": {"token", "user_id", "new_api_user", "provider"},
    "api_key": {"key", "header"},
    "cookie": {"cookie_string", "new_api_user", "user_id", "provider"},
    "login_password": {
        "email", "password", "login_path", "username_field", "new_api_user", "user_id", "provider",
        "token", "refresh_token", "expires_in", "token_expires_at", "refresh_path",
    },
}


def mask_auth_config(auth_type: str, cfg: dict) -> dict:
    masked = {}
    for k, v in cfg.items():
        if k.lower() in SECRET_KEYS and v:
            masked[k] = MASK
        else:
            masked[k] = v
    return masked


def normalize_auth_config(auth_type: str, cfg: dict) -> dict:
    allowed = AUTH_CONFIG_ALLOWED_KEYS.get(auth_type)
    if allowed is None:
        return cfg
    return {k: v for k, v in cfg.items() if k in allowed}