"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var AdminUsersService_1;
Object.defineProperty(exports, "__esModule", { value: true });
exports.AdminUsersService = void 0;
const common_1 = require("@nestjs/common");
const prisma_service_1 = require("../prisma/prisma.service");
const audit_service_1 = require("../audit/audit.service");
const crypto = __importStar(require("crypto"));
const shared_types_1 = require("@micprotocol/shared-types");
const admin_permission_decorator_1 = require("../common/decorators/admin-permission.decorator");
let AdminUsersService = AdminUsersService_1 = class AdminUsersService {
    prisma;
    audit;
    logger = new common_1.Logger(AdminUsersService_1.name);
    constructor(prisma, audit) {
        this.prisma = prisma;
        this.audit = audit;
    }
    async listUsers(input = {}) {
        const limit = Math.min(Math.max(input.limit ?? 50, 1), 200);
        const where = {
            ...(input.search
                ? {
                    OR: [
                        { email: { contains: input.search, mode: "insensitive" } },
                        { name: { contains: input.search, mode: "insensitive" } },
                    ],
                }
                : {}),
            ...(input.role ? { adminRole: input.role } : {}),
            ...(input.suspended !== undefined
                ? { suspendedAt: input.suspended ? { not: null } : { equals: null } }
                : {}),
        };
        const [total, items] = await Promise.all([
            this.prisma.user.count({ where }),
            this.prisma.user.findMany({
                where,
                orderBy: { createdAt: "desc" },
                take: limit + 1,
                ...(input.cursor ? { skip: 1, cursor: { id: input.cursor } } : {}),
                select: {
                    id: true,
                    name: true,
                    email: true,
                    isAdmin: true,
                    adminRole: true,
                    suspendedAt: true,
                    suspendedReason: true,
                    lastLoginAt: true,
                    createdAt: true,
                    _count: { select: { memberships: true } },
                },
            }),
        ]);
        const hasMore = items.length > limit;
        const page = hasMore ? items.slice(0, limit) : items;
        return {
            items: page.map((u) => ({
                id: u.id,
                name: u.name,
                email: u.email,
                isAdmin: u.isAdmin,
                adminRole: u.adminRole ?? null,
                suspended: !!u.suspendedAt,
                suspendedAt: u.suspendedAt,
                lastLoginAt: u.lastLoginAt,
                createdAt: u.createdAt,
                workspaceCount: u._count.memberships,
            })),
            total,
            nextCursor: hasMore ? page[page.length - 1]?.id ?? null : null,
        };
    }
    async getUser(userId) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: {
                id: true,
                name: true,
                email: true,
                emailVerified: true,
                isAdmin: true,
                adminRole: true,
                adminPermissions: true,
                suspendedAt: true,
                suspendedReason: true,
                suspendedBy: true,
                lastLoginAt: true,
                createdAt: true,
                updatedAt: true,
                _count: { select: { memberships: true } },
            },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        return user;
    }
    async suspendUser(userId, reason, actorUserId) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true, email: true, suspendedAt: true },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        if (user.suspendedAt)
            throw new common_1.BadRequestException("User is already suspended");
        const suspendedAt = new Date();
        const updated = await this.prisma.user.update({
            where: { id: userId },
            data: { suspendedAt, suspendedReason: reason ?? null, suspendedBy: actorUserId },
        });
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.suspend",
            entityType: "User",
            entityId: userId,
            metadata: {
                reason,
                before: { suspendedAt: null },
                after: { suspendedAt, suspendedReason: reason },
            },
        });
        return updated;
    }
    async reactivateUser(userId, actorUserId) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true, email: true, suspendedAt: true },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        if (!user.suspendedAt)
            throw new common_1.BadRequestException("User is not suspended");
        const updated = await this.prisma.user.update({
            where: { id: userId },
            data: { suspendedAt: null, suspendedReason: null, suspendedBy: null },
        });
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.reactivate",
            entityType: "User",
            entityId: userId,
            metadata: {
                before: { suspendedAt: user.suspendedAt },
                after: { suspendedAt: null },
            },
        });
        return updated;
    }
    async revokeSessions(userId, actorUserId, exceptToken) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        await this.prisma.session.deleteMany({
            where: { userId, ...(exceptToken ? { token: { not: exceptToken } } : {}) },
        });
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.revoke_sessions",
            entityType: "User",
            entityId: userId,
            metadata: { exceptToken: !!exceptToken },
        });
        return { revoked: true };
    }
    async impersonate(userId, actorUserId, reason, ttlMinutes = 60) {
        const target = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true, email: true, suspendedAt: true },
        });
        if (!target)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        if (target.suspendedAt)
            throw new common_1.BadRequestException("Cannot impersonate a suspended user");
        const token = crypto.randomBytes(24).toString("hex");
        const expiresAt = new Date(Date.now() + ttlMinutes * 60_000);
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.impersonate",
            entityType: "User",
            entityId: userId,
            metadata: {
                reason,
                expiresAt: expiresAt.toISOString(),
                impersonatedAs: userId,
            },
        });
        return { token, expiresAt, impersonateUserId: userId };
    }
    async grantAdmin(userId, role, permissions, actorUserId) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true, email: true, adminRole: true },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        const updated = await this.prisma.user.update({
            where: { id: userId },
            data: {
                adminRole: role,
                adminPermissions: permissions ?? {},
                isAdmin: true,
            },
        });
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.grant_admin",
            entityType: "User",
            entityId: userId,
            metadata: {
                before: { adminRole: user.adminRole },
                after: { adminRole: role, permissions },
            },
        });
        return updated;
    }
    async revokeAdmin(userId, actorUserId) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true, email: true, adminRole: true, isAdmin: true },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        const updated = await this.prisma.user.update({
            where: { id: userId },
            data: { adminRole: null, adminPermissions: {}, isAdmin: false },
        });
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.revoke_admin",
            entityType: "User",
            entityId: userId,
            metadata: {
                before: { adminRole: user.adminRole, isAdmin: user.isAdmin },
                after: { adminRole: null, isAdmin: false },
            },
        });
        return updated;
    }
    async deleteUser(userId, actorUserId, anonymize = true) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true, email: true, isAdmin: true },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        if (user.isAdmin)
            throw new common_1.BadRequestException("Refusing to delete an admin user; revoke admin first");
        if (anonymize) {
            await this.prisma.user.update({
                where: { id: userId },
                data: {
                    email: `deleted_${userId}@example.invalid`,
                    name: "Deleted User",
                    image: null,
                    passwordHash: null,
                    isAdmin: false,
                    adminRole: null,
                    adminPermissions: {},
                    suspendedAt: null,
                    isActive: false,
                },
            });
        }
        else {
            await this.prisma.user.delete({ where: { id: userId } });
        }
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.delete",
            entityType: "User",
            entityId: userId,
            metadata: { anonymize, email: user.email },
        });
        return { deleted: userId, anonymized: anonymize };
    }
    async addUserNote(userId, body, actorUserId) {
        const user = await this.prisma.user.findUnique({
            where: { id: userId },
            select: { id: true },
        });
        if (!user)
            throw new common_1.NotFoundException(`User ${userId} not found`);
        const note = await this.prisma.adminNote.create({
            data: { entityType: "User", entityId: userId, body, createdById: actorUserId },
        });
        await this.audit.log({
            userId: actorUserId,
            action: "admin.users.notes",
            entityType: "User",
            entityId: userId,
            metadata: { noteId: note.id },
        });
        return note;
    }
};
exports.AdminUsersService = AdminUsersService;
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_SUSPEND),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, Object, String]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "suspendUser", null);
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_SUSPEND),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "reactivateUser", null);
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_REVOKE_SESSIONS),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, String]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "revokeSessions", null);
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_IMPERSONATE),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, String, Object]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "impersonate", null);
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_GRANT_ADMIN),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, Object, String]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "grantAdmin", null);
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_GRANT_ADMIN),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "revokeAdmin", null);
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_DELETE),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, Object]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "deleteUser", null);
__decorate([
    (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_NOTES),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, String]),
    __metadata("design:returntype", Promise)
], AdminUsersService.prototype, "addUserNote", null);
exports.AdminUsersService = AdminUsersService = AdminUsersService_1 = __decorate([
    (0, common_1.Injectable)(),
    __metadata("design:paramtypes", [prisma_service_1.PrismaService,
        audit_service_1.AuditService])
], AdminUsersService);
//# sourceMappingURL=admin-users.service.js.map