"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __param = (this && this.__param) || function (paramIndex, decorator) {
    return function (target, key) { decorator(target, key, paramIndex); }
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.AccessControlController = void 0;
const common_1 = require("@nestjs/common");
const current_user_decorator_1 = require("../../common/decorators/current-user.decorator");
const zod_validation_pipe_1 = require("../../common/pipes/zod-validation.pipe");
const utils_1 = require("../../utils");
const jwt_guard_1 = require("../owner/guards/jwt.guard");
const access_control_dto_1 = require("./access-control.dto");
const access_control_service_1 = require("./access-control.service");
let AccessControlController = class AccessControlController {
    constructor(service) {
        this.service = service;
    }
    assertOwner(req) {
        if (req.user?.role !== 'owner') {
            throw (0, utils_1.createGeneralError)('Only the organization owner can manage access control', 'role', common_1.HttpStatus.FORBIDDEN);
        }
    }
    assertOwnerOrAdmin(req) {
        if (!['owner', 'admin'].includes(req.user?.role ?? '')) {
            throw (0, utils_1.createGeneralError)('You do not have permission to view access roles', 'role', common_1.HttpStatus.FORBIDDEN);
        }
    }
    async getMyPermissions(req, res) {
        const user = req.user;
        if (!user?.sub || !user?.owner_id) {
            throw (0, utils_1.createGeneralError)('Unauthorized', 'auth', common_1.HttpStatus.UNAUTHORIZED);
        }
        const result = await this.service.getMyPermissions({
            sub: user.sub,
            owner_id: user.owner_id,
            role: user.role ?? 'member',
            access_role_id: user.access_role_id ?? null,
        });
        return res.status(common_1.HttpStatus.OK).json(result);
    }
    async getPermissionCatalog(req, res) {
        this.assertOwner(req);
        const result = await this.service.getPermissionCatalog();
        return res.status(common_1.HttpStatus.OK).json(result);
    }
    async getRoles(owner_id, req, res) {
        this.assertOwnerOrAdmin(req);
        const result = await this.service.getRoles(owner_id);
        return res.status(common_1.HttpStatus.OK).json(result);
    }
    async getRoleById(roleId, owner_id, req, res) {
        this.assertOwner(req);
        const result = await this.service.getRoleById(roleId, owner_id);
        return res.status(common_1.HttpStatus.OK).json(result);
    }
    async createRole(data, owner_id, req, res) {
        this.assertOwner(req);
        const result = await this.service.createRole(data, owner_id);
        return res.status(common_1.HttpStatus.CREATED).json(result);
    }
    async updateRole(roleId, data, owner_id, req, res) {
        this.assertOwner(req);
        const result = await this.service.updateRole(roleId, data, owner_id);
        return res.status(common_1.HttpStatus.OK).json(result);
    }
    async deleteRole(roleId, owner_id, req, res) {
        this.assertOwner(req);
        const result = await this.service.deleteRole(roleId, owner_id);
        return res.status(common_1.HttpStatus.OK).json(result);
    }
};
exports.AccessControlController = AccessControlController;
__decorate([
    (0, common_1.UseGuards)(jwt_guard_1.JwtAuthGuard),
    (0, common_1.Get)('me/permissions'),
    __param(0, (0, common_1.Req)()),
    __param(1, (0, common_1.Res)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [Object, Object]),
    __metadata("design:returntype", Promise)
], AccessControlController.prototype, "getMyPermissions", null);
__decorate([
    (0, common_1.UseGuards)(jwt_guard_1.JwtAuthGuard),
    (0, common_1.Get)('permissions'),
    __param(0, (0, common_1.Req)()),
    __param(1, (0, common_1.Res)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [Object, Object]),
    __metadata("design:returntype", Promise)
], AccessControlController.prototype, "getPermissionCatalog", null);
__decorate([
    (0, common_1.UseGuards)(jwt_guard_1.JwtAuthGuard),
    (0, common_1.Get)('roles'),
    __param(0, (0, current_user_decorator_1.CurrentUser)()),
    __param(1, (0, common_1.Req)()),
    __param(2, (0, common_1.Res)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, Object, Object]),
    __metadata("design:returntype", Promise)
], AccessControlController.prototype, "getRoles", null);
__decorate([
    (0, common_1.UseGuards)(jwt_guard_1.JwtAuthGuard),
    (0, common_1.Get)('roles/:roleId'),
    __param(0, (0, common_1.Param)('roleId')),
    __param(1, (0, current_user_decorator_1.CurrentUser)()),
    __param(2, (0, common_1.Req)()),
    __param(3, (0, common_1.Res)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, Object, Object]),
    __metadata("design:returntype", Promise)
], AccessControlController.prototype, "getRoleById", null);
__decorate([
    (0, common_1.UseGuards)(jwt_guard_1.JwtAuthGuard),
    (0, common_1.UsePipes)(new zod_validation_pipe_1.ZodValidationPipe(access_control_dto_1.createAccessRoleSchema)),
    (0, common_1.Post)('roles'),
    __param(0, (0, common_1.Body)()),
    __param(1, (0, current_user_decorator_1.CurrentUser)()),
    __param(2, (0, common_1.Req)()),
    __param(3, (0, common_1.Res)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [Object, String, Object, Object]),
    __metadata("design:returntype", Promise)
], AccessControlController.prototype, "createRole", null);
__decorate([
    (0, common_1.UseGuards)(jwt_guard_1.JwtAuthGuard),
    (0, common_1.UsePipes)(new zod_validation_pipe_1.ZodValidationPipe(access_control_dto_1.updateAccessRoleSchema)),
    (0, common_1.Patch)('roles/:roleId'),
    __param(0, (0, common_1.Param)('roleId')),
    __param(1, (0, common_1.Body)()),
    __param(2, (0, current_user_decorator_1.CurrentUser)()),
    __param(3, (0, common_1.Req)()),
    __param(4, (0, common_1.Res)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, Object, String, Object, Object]),
    __metadata("design:returntype", Promise)
], AccessControlController.prototype, "updateRole", null);
__decorate([
    (0, common_1.UseGuards)(jwt_guard_1.JwtAuthGuard),
    (0, common_1.Delete)('roles/:roleId'),
    __param(0, (0, common_1.Param)('roleId')),
    __param(1, (0, current_user_decorator_1.CurrentUser)()),
    __param(2, (0, common_1.Req)()),
    __param(3, (0, common_1.Res)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, Object, Object]),
    __metadata("design:returntype", Promise)
], AccessControlController.prototype, "deleteRole", null);
exports.AccessControlController = AccessControlController = __decorate([
    (0, common_1.Controller)('access-control'),
    __metadata("design:paramtypes", [access_control_service_1.AccessControlService])
], AccessControlController);
//# sourceMappingURL=access-control.controller.js.map