# SPDX-License-Identifier: BSD-2-Clause
# SPDX-FileCopyrightText: 2026 KDE e.V.

"""Whitelist of allowed macOS entitlements for KDE projects."""

import plistlib

# Allowed entitlement keys - any entitlement not in this list is rejected
ALLOWED_ENTITLEMENTS = {
    # Allow loading libraries with different code signatures
    # Required e.g. for Python/scripting apps that load user-installed packages
    "com.apple.security.cs.disable-library-validation",
    # Allow access to the microphone
    # Required e.g. for Kdenlive
    "com.apple.security.device.audio-input",
}


def validate_entitlements_file(file_path):
    """
    Parse and validate an entitlements plist file.

    Args:
        file_path: Path to the .entitlements file

    Raises:
        ValueError: If any entitlement is not in the whitelist
    """
    with open(file_path, "rb") as f:
        entitlements = plistlib.load(f)

    for key in entitlements.keys():
        if key not in ALLOWED_ENTITLEMENTS:
            raise ValueError(f"Entitlement not allowed: {key}")