"""Security Allowlist - Defines safe, read-only commands."""

from typing import Dict, List, Set
from doctor.core.os_detect import is_windows, is_macos, is_linux


# Read-only commands allowed per OS
ALLOWED_COMMANDS: Dict[str, List[List[str]]] = {
    "windows": [
        ["wmic", "cpu", "get", "loadpercentage"],
        ["wmic", "os", "get", "lastbootuptime"],
        ["wmic", "logicaldisk", "get", "size,freespace,caption"],
        ["wmic", "computersystem", "get", "totalphysicalmemory"],
        ["tasklist", "/FO", "CSV", "/NH"],
        ["wmic", "battery", "get", "batterystatus,estimatedchargeremaining"],
    ],
    "macos": [
        ["sysctl", "-n", "machdep.cpu.brand_string"],
        ["sysctl", "-n", "hw.memsize"],
        ["sysctl", "-n", "kern.boottime"],
        ["df", "-h"],
        ["ps", "-eo", "pid,pcpu,pmem,comm", "-r"],
        ["pmset", "-g", "batt"],
        ["uptime"],
    ],
    "linux": [
        ["cat", "/proc/loadavg"],
        ["cat", "/proc/meminfo"],
        ["cat", "/proc/uptime"],
        ["df", "-h"],
        ["ps", "-eo", "pid,pcpu,pmem,comm", "--sort=-pcpu"],
        ["cat", "/sys/class/power_supply/BAT*/capacity"],
        ["uptime"],
    ],
}


def get_allowed_commands() -> List[List[str]]:
    """
    Get allowed commands for the current OS.
    
    Returns:
        List of command lists (each command is a list of strings).
    """
    if is_windows():
        return ALLOWED_COMMANDS.get("windows", [])
    elif is_macos():
        return ALLOWED_COMMANDS.get("macos", [])
    elif is_linux():
        return ALLOWED_COMMANDS.get("linux", [])
    return []


def is_command_allowed(command: List[str]) -> bool:
    """
    Check if a command is in the allowlist.
    
    Args:
        command: List of command parts (e.g., ["ps", "-eo", "pid"]).
        
    Returns:
        True if command is allowed, False otherwise.
    """
    allowed = get_allowed_commands()
    return command in allowed


def get_command_signature(command: List[str]) -> str:
    """
    Get a normalized signature for a command (for logging).
    
    Args:
        command: List of command parts.
        
    Returns:
        String signature of the command.
    """
    return " ".join(command)
