"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.assertToggle = assertToggle;
exports.assertScope = assertScope;
exports.resolveDataScope = resolveDataScope;
exports.buildMemberFilter = buildMemberFilter;
exports.buildMemberEntityFilter = buildMemberEntityFilter;
exports.canPerformScopedAction = canPerformScopedAction;
exports.assertScopedAction = assertScopedAction;
exports.isSelfMemberRequest = isSelfMemberRequest;
exports.stripSelfMemberUpdateFields = stripSelfMemberUpdateFields;
exports.assertGeneralModuleAccess = assertGeneralModuleAccess;
exports.assertSettingsModuleAccess = assertSettingsModuleAccess;
exports.assertPermissionsModuleAccess = assertPermissionsModuleAccess;
exports.assertRecruitmentModuleAccess = assertRecruitmentModuleAccess;
exports.assertOnboardingModuleAccess = assertOnboardingModuleAccess;
const common_1 = require("@nestjs/common");
const typeorm_1 = require("typeorm");
const utils_1 = require("../../utils");
function assertToggle(permissions, key) {
    if (permissions[key] !== 'true') {
        throw (0, utils_1.createGeneralError)('You do not have permission to perform this action', key, common_1.HttpStatus.FORBIDDEN);
    }
}
function assertScope(permissions, key) {
    const value = permissions[key];
    if (value === 'none' ||
        value === undefined ||
        value === 'true' ||
        value === 'false') {
        throw (0, utils_1.createGeneralError)('You do not have permission to access this resource', key, common_1.HttpStatus.FORBIDDEN);
    }
    return value;
}
function resolveDataScope(permissions, viewKey, requested, ctx) {
    const scope = assertScope(permissions, viewKey);
    if (ctx?.role === 'owner') {
        return 'org';
    }
    if (scope === 'own') {
        if (requested === 'all') {
            throw (0, utils_1.createGeneralError)('All members data scope is not allowed for this permission', viewKey, common_1.HttpStatus.FORBIDDEN);
        }
        return 'own';
    }
    if (scope === 'all') {
        if (requested === 'own') {
            throw (0, utils_1.createGeneralError)('Own data scope is not allowed for this permission', viewKey, common_1.HttpStatus.FORBIDDEN);
        }
        return 'org';
    }
    if (scope === 'own_and_all') {
        const mode = requested ?? 'own';
        return mode === 'all' ? 'org' : 'own';
    }
    throw (0, utils_1.createGeneralError)('You do not have permission to access this resource', viewKey, common_1.HttpStatus.FORBIDDEN);
}
function buildMemberFilter(filter, actorMemberId) {
    if (filter === 'own') {
        return { member_id: actorMemberId };
    }
    if (filter === 'all_others') {
        return { member_id: (0, typeorm_1.Not)(actorMemberId) };
    }
    return {};
}
function buildMemberEntityFilter(filter, actorMemberId) {
    if (filter === 'own') {
        return { id: actorMemberId };
    }
    if (filter === 'all_others') {
        return { id: (0, typeorm_1.Not)(actorMemberId) };
    }
    return {};
}
function canPerformScopedAction(permissions, actionKey, targetMemberId, actorMemberId) {
    const scope = permissions[actionKey];
    if (scope === 'none' || scope === undefined || scope === 'true' || scope === 'false') {
        return false;
    }
    if (scope === 'own') {
        return targetMemberId === actorMemberId;
    }
    if (scope === 'all') {
        return targetMemberId !== actorMemberId;
    }
    if (scope === 'own_and_all') {
        return true;
    }
    return false;
}
function assertScopedAction(permissions, actionKey, targetMemberId, actorMemberId) {
    if (!canPerformScopedAction(permissions, actionKey, targetMemberId, actorMemberId)) {
        throw (0, utils_1.createGeneralError)('You do not have permission to perform this action', actionKey, common_1.HttpStatus.FORBIDDEN);
    }
}
function isSelfMemberRequest(ctx, targetMemberId) {
    return ctx.role !== 'owner' && ctx.sub === targetMemberId;
}
const SELF_MEMBER_BLOCKED_UPDATE_FIELDS = [
    'access_role_id',
    'role',
    'status',
    'employee_id',
    'department_id',
    'designation_id',
    'location_id',
    'employment_type_id',
    'hiring_source_id',
    'reporting_manager_id',
    'date_of_joining',
];
function stripSelfMemberUpdateFields(data) {
    const stripped = { ...data };
    for (const field of SELF_MEMBER_BLOCKED_UPDATE_FIELDS) {
        delete stripped[field];
    }
    return stripped;
}
function assertGeneralModuleAccess(permissions, manage = false) {
    assertToggle(permissions, 'general.access');
    if (manage) {
        assertToggle(permissions, 'general.manage');
    }
}
function assertSettingsModuleAccess(permissions, manage = false) {
    assertToggle(permissions, 'settings.access');
    if (manage) {
        assertToggle(permissions, 'settings.manage');
    }
}
function assertPermissionsModuleAccess(permissions, manage = false) {
    assertToggle(permissions, 'permissions.access');
    if (manage) {
        assertToggle(permissions, 'permissions.manage');
    }
}
function assertRecruitmentModuleAccess(permissions, options = {}) {
    assertToggle(permissions, 'recruitment.access');
    if (options.manage) {
        assertToggle(permissions, 'recruitment.manage');
    }
    if (options.apiKeys) {
        assertToggle(permissions, 'recruitment.api_keys');
    }
}
function assertOnboardingModuleAccess(permissions, options = {}) {
    assertToggle(permissions, 'onboarding.access');
    if (options.manage) {
        assertToggle(permissions, 'onboarding.manage');
    }
    if (options.convert) {
        assertToggle(permissions, 'onboarding.convert_member');
    }
}
//# sourceMappingURL=permission-resolver.helpers.js.map