"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.accessRolesResponseSchema = exports.accessRoleResponseSchema = exports.updateAccessRoleSchema = exports.createAccessRoleSchema = exports.permissionMapSchema = void 0;
const zod_1 = require("zod");
const shared_dto_1 = require("../shared/shared.dto");
const permission_catalog_1 = require("./permission-catalog");
const optionalString = zod_1.z.preprocess((value) => {
    if (typeof value === 'string' && value.trim() === '')
        return undefined;
    return value;
}, zod_1.z.string().trim().optional());
const optionalUuid = zod_1.z.preprocess((value) => {
    if (typeof value === 'string' && value.trim() === '')
        return undefined;
    return value;
}, zod_1.z.string().uuid().optional());
exports.permissionMapSchema = zod_1.z
    .record(zod_1.z.string(), zod_1.z.string())
    .superRefine((value, ctx) => {
    for (const [key, permissionValue] of Object.entries(value)) {
        if (!permission_catalog_1.ALL_PERMISSION_KEYS.includes(key)) {
            ctx.addIssue({
                code: zod_1.z.ZodIssueCode.custom,
                message: `Unknown permission key: ${key}`,
                path: [key],
            });
            continue;
        }
        if (!(0, permission_catalog_1.isValidPermissionValue)(key, permissionValue)) {
            ctx.addIssue({
                code: zod_1.z.ZodIssueCode.custom,
                message: `Invalid value for ${key}`,
                path: [key],
            });
        }
    }
});
exports.createAccessRoleSchema = zod_1.z.object({
    name: zod_1.z
        .string()
        .trim()
        .min(2, { message: 'Role name must be at least 2 characters long' }),
    description: optionalString,
    source_role_id: optionalUuid,
});
exports.updateAccessRoleSchema = zod_1.z
    .object({
    name: zod_1.z.string().trim().min(2).optional(),
    description: optionalString,
    permissions: exports.permissionMapSchema.optional(),
})
    .refine((data) => Object.keys(data).length > 0, {
    message: 'At least one field must be provided',
});
exports.accessRoleResponseSchema = zod_1.z.object({
    id: zod_1.z.string().uuid(),
    name: zod_1.z.string(),
    slug: zod_1.z.string(),
    description: shared_dto_1.defaultTransformSchema,
    is_system: zod_1.z.boolean(),
    hierarchy: zod_1.z.number(),
    permissions: zod_1.z.record(zod_1.z.string(), zod_1.z.string()),
    created_at: zod_1.z.coerce.date(),
    updated_at: zod_1.z.coerce.date(),
});
exports.accessRolesResponseSchema = zod_1.z.array(exports.accessRoleResponseSchema);
//# sourceMappingURL=access-control.dto.js.map