"""Trusted repository configuration and opt-in policy."""
from __future__ import annotations

import base64
import json
import urllib.parse
from collections.abc import Callable


def repo_enabled(
    get: Callable[..., tuple[int, bytes]],
    api: str,
    repo: str,
    ref: str,
    token: str,
) -> bool:
    """Read the opt-in flag from the trusted base branch.

    The transport is injected so the policy is testable without a live Gitea.
    Any missing, malformed, or non-boolean value disables review.
    """
    path = "contents/.pr-review.json?ref=" + urllib.parse.quote(ref, safe="")
    status, raw = get(api, repo, path, token)
    if status != 200:
        return False
    try:
        envelope = json.loads(raw)
        encoded = envelope.get("content", "").replace("\n", "")
        config = json.loads(base64.b64decode(encoded).decode("utf-8", errors="replace"))
    except (AttributeError, TypeError, ValueError, json.JSONDecodeError):
        return False
    return isinstance(config, dict) and config.get("enabled") is True