"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var AdminAuthService_1;
Object.defineProperty(exports, "__esModule", { value: true });
exports.AdminAuthService = void 0;
const common_1 = require("@nestjs/common");
const server_1 = require("@trpc/server");
const prisma_service_1 = require("../prisma/prisma.service");
const shared_types_1 = require("@micprotocol/shared-types");
const platform_admin_1 = require("../common/platform-admin");
let AdminAuthService = AdminAuthService_1 = class AdminAuthService {
    prisma;
    logger = new common_1.Logger(AdminAuthService_1.name);
    constructor(prisma) {
        this.prisma = prisma;
    }
    async getAdminContext(userId) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: {
                id: true,
                isAdmin: true,
                adminRole: true,
                adminPermissions: true,
                suspendedAt: true,
            },
        });
        if (!user)
            return null;
        const role = (0, platform_admin_1.deriveAdminRole)(user);
        if (!role)
            return null;
        const permissions = (0, shared_types_1.resolveAdminPermissions)(role, user.adminPermissions);
        const suspended = !!user.suspendedAt;
        return {
            userId: user.id,
            isAdmin: !!user.isAdmin,
            role,
            permissions,
            suspended,
        };
    }
    async requirePermission(userId, permission) {
        const ctx = await this.getAdminContext(userId);
        if (!ctx) {
            throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Admin privileges required" });
        }
        if (ctx.suspended) {
            throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Account is suspended" });
        }
        if (!ctx.permissions.has(permission)) {
            throw new server_1.TRPCError({
                code: "FORBIDDEN",
                message: `Insufficient permissions: ${permission} required`,
            });
        }
        return ctx;
    }
    async requireAnyPermission(userId, ...permissions) {
        const ctx = await this.getAdminContext(userId);
        if (!ctx || ctx.suspended) {
            throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Admin privileges required" });
        }
        const hasAny = permissions.some((p) => ctx.permissions.has(p));
        if (!hasAny) {
            throw new server_1.TRPCError({
                code: "FORBIDDEN",
                message: `Insufficient permissions: one of ${permissions.join(", ")} required`,
            });
        }
        return ctx;
    }
};
exports.AdminAuthService = AdminAuthService;
exports.AdminAuthService = AdminAuthService = AdminAuthService_1 = __decorate([
    (0, common_1.Injectable)(),
    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
], AdminAuthService);
//# sourceMappingURL=admin-auth.service.js.map