"""Trusted dev-mode gating helpers.

These guards prevent single-env-var bypasses in public wheel installs.
"""

from __future__ import annotations

import os
from pathlib import Path

_TRUTHY = {"1", "true", "yes", "on"}


def _env_true(name: str) -> bool:
    return os.getenv(name, "").strip().lower() in _TRUTHY


def is_trusted_dev_context(module_file: Path | None = None) -> bool:
    """
    Return True only when running from a source checkout.

    Trusted context is defined as a parent directory that contains both
    `.git` and `pyproject.toml`. This does not exist in normal wheel installs.
    """
    target = (module_file or Path(__file__)).resolve()
    for parent in target.parents:
        if (parent / ".git").exists() and (parent / "pyproject.toml").exists():
            return True
        # Stop once we reach typical installed package roots.
        if parent.name in {"site-packages", "dist-packages"}:
            break
    return False


def is_dev_mode_enabled(module_file: Path | None = None) -> bool:
    """
    Dev mode requires two signals:
    1) `G_GREMLIN_DEV_MODE=1`
    2) trusted local source-checkout context
    """
    return _env_true("G_GREMLIN_DEV_MODE") and is_trusted_dev_context(module_file)

