"""Credential assurance required by both Gateway and LangGraph sessions."""

from app.gateway.auth.jwt import TokenPayload
from deerflow.config.system_settings import load_system_settings


def session_policy_error(payload: TokenPayload) -> str | None:
    """Return a rejection reason for a signed but no longer permitted session."""
    policy = load_system_settings().authentication
    if payload.auth_method == "sso" and not policy.sso_enabled:
        return "外部系统免登已关闭，请使用账号密码重新登录"
    if policy.password_login_enabled and payload.auth_method not in {"password", "passphrase", "sso"}:
        return "已开启登录验证，请重新登录"
    return None