"""Session tools: who the connected client is acting as."""
from __future__ import annotations

from steward.mcp._context import current_caller
from steward.models.users import UserRole

_ROLE_MEANS = {
    UserRole.viewer: "Read-only: every list_*/get_* tool. Nothing that changes Steward or your hosts.",
    UserRole.operator: "Viewer tools, plus running playbooks (check mode unless told otherwise) "
                       "and changing monitors, alerts and schedules.",
    UserRole.admin: "Everything, including the playbook an alert rule runs, pruning Docker disk, "
                    "and deleting monitors and alert rules.",
}


async def whoami() -> dict:
    """Who this connection acts as in Steward, and what that role may do.

    Call this first if a tool refuses you for lack of role: `role` is the
    LOWER of the token's ceiling and its user's current role, so it can be
    less than the token was created with. A higher role needs a new token
    from Steward's AI access page, and only up to the user's own role.
    """
    caller = current_caller()
    return {
        "user": caller.username,
        "user_id": caller.user_id,
        "role": caller.role.value,
        "role_allows": _ROLE_MEANS[caller.role],
        "token_id": caller.token_id,
    }


def register(register_tool) -> None:
    register_tool(whoami, role=UserRole.viewer, read_only=True)