"""Check completed upload identity without requiring Apple's optional checksum attribute."""
from __future__ import annotations

import base64
import hashlib
from pathlib import Path


def completed(ipa: Path, attributes: dict, info: dict) -> None:
    if any(attributes.get(key) != info[key] for key in ("fileName", "fileSize")):
        raise ValueError("Apple's completed file identity does not match this IPA")
    checksum = (attributes.get("sourceFileChecksums") or {}).get("file")
    if checksum is None:
        # The name is the local SHA-256 plus .ipa; upload_file verified this same
        # provider-owned file identity before any transfer or completed-file reuse.
        return
    algorithm = {"SHA_256": "sha256", "MD5": "md5"}.get(checksum.get("algorithm"))
    if algorithm is None:
        raise ValueError("Apple returned an unsupported completed-file checksum algorithm")
    with ipa.open("rb") as stream:
        digest = hashlib.file_digest(stream, algorithm)
    expected = {digest.hexdigest(), digest.hexdigest().upper(), base64.b64encode(digest.digest()).decode()}
    if checksum.get("hash") not in expected:
        raise ValueError("Apple's completed file checksum does not match this IPA")