from __future__ import annotations

from typing import Mapping


CONNECTED_MAIL_OAUTH_ENV_KEYS = (
    "NEXUSCRM_INTEGRATION_CONNECTED_MAIL_OAUTH_CLIENT_ID",
    "NEXUSCRM_INTEGRATION_CONNECTED_MAIL_OAUTH_CLIENT_SECRET",
)


def connected_mail_oauth_env(
    environ: Mapping[str, str],
    *,
    error_type: type[Exception] = ValueError,
) -> dict[str, str]:
    """Return one canonical optional OAuth pair or fail before deployment work."""
    values = {
        key: str(environ.get(key, ""))
        for key in CONNECTED_MAIL_OAUTH_ENV_KEYS
    }
    for key, value in values.items():
        if value and (
            value.strip() != value
            or "\x00" in value
            or "\n" in value
            or "\r" in value
        ):
            raise error_type(f"connected-mail OAuth authority has non-canonical {key}")
    present = [key for key, value in values.items() if value]
    if not present:
        return {}
    if len(present) != len(CONNECTED_MAIL_OAUTH_ENV_KEYS):
        raise error_type(
            "connected-mail OAuth client ID and secret must be supplied together"
        )
    return values