"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __param = (this && this.__param) || function (paramIndex, decorator) {
    return function (target, key) { decorator(target, key, paramIndex); }
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.AdminUsersController = void 0;
const common_1 = require("@nestjs/common");
const common_2 = require("@nestjs/common");
const typeorm_1 = require("@nestjs/typeorm");
const typeorm_2 = require("typeorm");
const admin_session_guard_1 = require("../guards/admin-session.guard");
const auth_exception_filter_1 = require("../../auth/filters/auth-exception.filter");
const swagger_1 = require("@nestjs/swagger");
const core_1 = require("../../core");
const admin_user_dto_1 = require("../dto/admin-user.dto");
const user_service_1 = require("../../user/services/user.service");
const admin_user_management_service_1 = require("../services/admin-user-management.service");
const tenant_service_1 = require("../../tenant/services/tenant.service");
const mfa_secret_entity_1 = require("../../auth/entities/mfa-secret.entity");
const auth_constants_1 = require("../../auth.constants");
const typeorm_3 = require("typeorm");
const mfa_service_1 = require("../../auth/services/mfa.service");
const session_manager_service_1 = require("../../session/services/session-manager.service");
const auth_config_service_1 = require("../../core/services/auth-config.service");
const user_access_entity_1 = require("../../user/entities/user-access.entity");
const nest_auth_contracts_1 = require("@ackplus/nest-auth-contracts");
const role_mapper_util_1 = require("../../role/utils/role-mapper.util");
const trusted_device_entity_1 = require("../../auth/entities/trusted-device.entity");
let AdminUsersController = class AdminUsersController {
    users;
    adminUserManagement;
    tenantService;
    authConfigService;
    mfaService;
    sessionManager;
    mfaSecretRepository;
    userAccessRepository;
    trustedDeviceRepository;
    constructor(users, adminUserManagement, tenantService, authConfigService, mfaService, sessionManager, mfaSecretRepository, userAccessRepository, trustedDeviceRepository) {
        this.users = users;
        this.adminUserManagement = adminUserManagement;
        this.tenantService = tenantService;
        this.authConfigService = authConfigService;
        this.mfaService = mfaService;
        this.sessionManager = sessionManager;
        this.mfaSecretRepository = mfaSecretRepository;
        this.userAccessRepository = userAccessRepository;
        this.trustedDeviceRepository = trustedDeviceRepository;
    }
    async ensureUserExists(id) {
        const user = await this.users.getUserById(id);
        if (!user) {
            throw new common_2.NotFoundException('User not found');
        }
        return user;
    }
    toSessionResponse(session) {
        return {
            id: session.id,
            userId: session.userId,
            deviceName: session.deviceName || 'Unknown device',
            userAgent: session.userAgent,
            ipAddress: session.ipAddress,
            lastActive: session.lastActive,
            createdAt: session.createdAt,
            expiresAt: session.expiresAt,
        };
    }
    buildStatusFilter(status) {
        if (!status)
            return {};
        switch (status) {
            case 'active':
                return { isActive: true };
            case 'inactive':
                return { isActive: false };
            case 'verified':
                return { emailVerifiedAt: (0, typeorm_2.Not)((0, typeorm_2.IsNull)()) };
            case 'unverified':
                return { emailVerifiedAt: (0, typeorm_2.IsNull)() };
            default:
                return {};
        }
    }
    escapeLikePattern(value) {
        return value.replace(/[%_\\]/g, '\\$&');
    }
    async resolveTenantIds(tenantIds = []) {
        if (!tenantIds.length) {
            return [];
        }
        const resolved = await Promise.all(tenantIds.map((id) => this.tenantService.resolveTenantId(id)));
        const resolvedSet = Array.from(new Set(resolved.filter(Boolean)));
        const unresolved = tenantIds.filter((id, i) => !resolved[i]);
        if (unresolved.length > 0) {
            throw new common_1.BadRequestException(`Invalid or unresolved tenant ID(s): ${unresolved.join(', ')}`);
        }
        return resolvedSet;
    }
    async listUsers(page, limit, search, status, tenantId, roleName) {
        let pageNum = parseInt(page || '1', 10);
        let limitNum = parseInt(limit || '10', 10);
        if (isNaN(pageNum) || pageNum < 1) {
            pageNum = 1;
        }
        if (isNaN(limitNum) || limitNum <= 0) {
            limitNum = 10;
        }
        if (limitNum > 100) {
            limitNum = 100;
        }
        const skip = (pageNum - 1) * limitNum;
        const baseFilter = {
            ...this.buildStatusFilter(status),
        };
        if (tenantId && tenantId.trim()) {
            baseFilter.userAccesses = { tenantId: tenantId.trim() };
        }
        if (roleName && roleName.trim()) {
            baseFilter.roles = { name: roleName.trim() };
        }
        let where = baseFilter;
        if (search && search.trim()) {
            const escapedSearch = this.escapeLikePattern(search.trim());
            const searchPattern = `%${escapedSearch}%`;
            where = [
                { ...baseFilter, email: (0, typeorm_3.Like)(searchPattern) },
                { ...baseFilter, phone: (0, typeorm_3.Like)(searchPattern) },
            ];
        }
        const [users, total] = await this.users.getUsersAndCount({
            where,
            relations: [
                'userAccesses',
                'userAccesses.tenant',
                'userAccesses.roles',
                'userAccesses.roles.rolePermissions',
                'userAccesses.roles.rolePermissions.permission',
            ],
            order: { createdAt: 'DESC' },
            skip,
            take: limitNum,
        });
        const safeUsers = await Promise.all(users.map((user) => this.toSafeUser(user)));
        return {
            data: safeUsers,
            meta: {
                page: pageNum,
                limit: limitNum,
                total,
                totalPages: Math.ceil(total / limitNum),
            },
        };
    }
    async createUser(dto) {
        const config = this.authConfigService.getConfig();
        const tenantEnabled = config.tenant?.enabled === true;
        const tenantMode = config.tenant?.mode ?? nest_auth_contracts_1.TenantModeEnum.ISOLATED;
        let tenantId;
        if (tenantEnabled && tenantMode === nest_auth_contracts_1.TenantModeEnum.ISOLATED) {
            if (!dto.tenantId?.trim()) {
                throw new common_1.BadRequestException('tenantId is required when tenant mode is isolated');
            }
            const tenant = await this.tenantService.getTenantById(dto.tenantId.trim());
            if (!tenant) {
                throw new common_2.NotFoundException('Tenant not found');
            }
            tenantId = dto.tenantId.trim();
        }
        const user = await this.users.createUser({
            email: dto.email,
            phone: dto.phone,
            metadata: dto.metadata ?? {},
            isActive: dto.isActive ?? true,
            emailVerifiedAt: dto.emailVerifiedAt ?? null,
            phoneVerifiedAt: dto.phoneVerifiedAt ?? null,
        }, tenantId);
        const safeUser = await this.toSafeUser(user);
        return { user: safeUser };
    }
    async getUser(id) {
        const user = await this.users.getUserById(id, {
            relations: [
                'mfaSecrets',
                'identities',
                'userAccesses',
                'userAccesses.tenant',
                'userAccesses.roles',
                'userAccesses.roles.rolePermissions',
                'userAccesses.roles.rolePermissions.permission',
            ]
        });
        if (!user) {
            throw new common_2.NotFoundException('User not found');
        }
        const config = this.authConfigService.getConfig();
        const emailAuthEnabled = config.emailAuth?.enabled !== false;
        const phoneAuthEnabled = config.phoneAuth?.enabled === true;
        const passwordlessEnabled = config.passwordless?.enabled === true;
        const identities = (user.identities ?? []);
        const hasEmailIdentity = (user.identities ?? []).some((i) => i.provider === auth_constants_1.EMAIL_AUTH_PROVIDER && i.providerId === user.email);
        const hasPhoneIdentity = (user.identities ?? []).some((i) => i.provider === auth_constants_1.PHONE_AUTH_PROVIDER && i.providerId === user.phone);
        const socialProviders = [
            config.google?.clientId ? 'google' : null,
            config.github?.clientId ? 'github' : null,
            config.facebook?.appId ? 'facebook' : null,
            config.apple?.clientId ? 'apple' : null,
        ].filter(Boolean);
        const socialIdentities = (user.identities ?? [])
            .filter((i) => ![auth_constants_1.EMAIL_AUTH_PROVIDER, auth_constants_1.PHONE_AUTH_PROVIDER].includes(i.provider))
            .map((i) => i.provider);
        const availableMethods = this.mfaService.getAvailableMethods();
        const enabledMethods = await this.mfaService.getEnabledMethods(user.id);
        const sessions = await this.sessionManager.getUserSessions(user.id);
        const sortedSessions = sessions
            .sort((a, b) => {
            const aTime = a.lastActive?.getTime() ?? a.updatedAt?.getTime() ?? 0;
            const bTime = b.lastActive?.getTime() ?? b.updatedAt?.getTime() ?? 0;
            return bTime - aTime;
        })
            .map((session) => this.toSessionResponse(session));
        const safeUser = await this.toSafeUser(user);
        const trustedDevices = await this.trustedDeviceRepository.find({
            where: { userId: user.id },
            order: { lastUsedAt: 'DESC', createdAt: 'DESC' },
            take: 50,
        });
        const mfaEnabledForApp = config.mfa?.enabled === true;
        const mfaRequiredForAll = config.mfa?.required === true;
        const mfaRequiredForUser = mfaEnabledForApp && (mfaRequiredForAll || user.isMfaEnabled === true);
        return {
            user: safeUser,
            identities,
            trustedDevices: trustedDevices,
            loginCapabilities: {
                email: {
                    enabledInConfig: emailAuthEnabled,
                    hasIdentity: hasEmailIdentity,
                    verified: !!user.emailVerifiedAt,
                    canPasswordLogin: emailAuthEnabled && hasEmailIdentity && !!user.passwordHash,
                    canOtpLogin: emailAuthEnabled && passwordlessEnabled && hasEmailIdentity,
                },
                phone: {
                    enabledInConfig: phoneAuthEnabled,
                    hasIdentity: hasPhoneIdentity,
                    canPasswordLogin: phoneAuthEnabled && hasPhoneIdentity && !!user.passwordHash,
                    verified: !!user.phoneVerifiedAt,
                    canOtpLogin: phoneAuthEnabled && passwordlessEnabled && hasPhoneIdentity,
                },
                passwordless: {
                    enabledInConfig: passwordlessEnabled,
                    allowSignUp: config.passwordless?.allowSignUp === true,
                },
                social: {
                    enabledProviders: socialProviders,
                    identityProviders: Array.from(new Set(socialIdentities)),
                },
                mfa: {
                    enabledInConfig: mfaEnabledForApp,
                    requiredForAll: mfaRequiredForAll,
                    requiredForUser: mfaRequiredForUser,
                },
            },
            mfa: {
                isEnabled: user.isMfaEnabled,
                allowUserToggle: this.mfaService.mfaConfig?.allowUserToggle ?? false,
                availableMethods,
                enabledMethods,
                hasRecoveryCode: !!user.mfaRecoveryCode,
                totpDevices: user.mfaSecrets?.map((device) => ({
                    id: device.id,
                    deviceName: device.deviceName || 'Authenticator',
                    verified: device.verified,
                    lastUsedAt: device.lastUsedAt,
                    createdAt: device.createdAt,
                })) || [],
            },
            sessions: sortedSessions,
        };
    }
    async updateUser(id, dto) {
        let user = await this.users.getUserById(id, {
            relations: [
                'identities',
                'userAccesses',
                'userAccesses.tenant',
                'userAccesses.roles',
                'userAccesses.roles.rolePermissions',
                'userAccesses.roles.rolePermissions.permission',
            ],
        });
        if (!user) {
            throw new common_2.NotFoundException('User not found');
        }
        const oldEmail = user.email;
        const oldPhone = user.phone;
        if (dto.isActive !== undefined || dto.emailVerifiedAt !== undefined || dto.phoneVerifiedAt !== undefined || dto.metadata !== undefined ||
            dto.isMfaEnabled !== undefined || dto.email !== undefined || dto.phone !== undefined) {
            const updates = {};
            if (dto.isActive !== undefined)
                updates.isActive = dto.isActive;
            if (dto.emailVerifiedAt !== undefined)
                updates.emailVerifiedAt = dto.emailVerifiedAt;
            if (dto.phoneVerifiedAt !== undefined)
                updates.phoneVerifiedAt = dto.phoneVerifiedAt;
            if (dto.metadata !== undefined)
                updates.metadata = dto.metadata;
            if (dto.isMfaEnabled !== undefined)
                updates.isMfaEnabled = dto.isMfaEnabled;
            if (dto.email !== undefined)
                updates.email = dto.email;
            if (dto.phone !== undefined)
                updates.phone = dto.phone;
            user = await this.users.updateUser(id, updates);
        }
        if (dto.email !== undefined && dto.email !== oldEmail) {
            if (oldEmail) {
                const oldEmailIdentity = user.identities?.find(i => i.provider === auth_constants_1.EMAIL_AUTH_PROVIDER && i.providerId === oldEmail);
                if (oldEmailIdentity) {
                    await oldEmailIdentity.remove();
                }
            }
            if (dto.email && user.emailVerifiedAt) {
                await user.findOrCreateIdentity(auth_constants_1.EMAIL_AUTH_PROVIDER, dto.email);
            }
        }
        if (dto.phone !== undefined && dto.phone !== oldPhone) {
            if (oldPhone) {
                const oldPhoneIdentity = user.identities?.find(i => i.provider === auth_constants_1.PHONE_AUTH_PROVIDER && i.providerId === oldPhone);
                if (oldPhoneIdentity) {
                    await oldPhoneIdentity.remove();
                }
            }
            if (dto.phone && user.phoneVerifiedAt) {
                await user.findOrCreateIdentity(auth_constants_1.PHONE_AUTH_PROVIDER, dto.phone);
            }
        }
        if (dto.emailLoginEnabled !== undefined) {
            if (dto.emailLoginEnabled) {
                if (!user.email) {
                    throw new common_2.NotFoundException('User has no email address');
                }
                user.emailVerifiedAt = user.emailVerifiedAt || new Date();
                await user.findOrCreateIdentity(auth_constants_1.EMAIL_AUTH_PROVIDER, user.email);
            }
            else {
                user.emailVerifiedAt = null;
                const emailIdentity = user.identities?.find(i => i.provider === auth_constants_1.EMAIL_AUTH_PROVIDER);
                if (emailIdentity) {
                    await emailIdentity.remove();
                }
            }
        }
        if (dto.phoneLoginEnabled !== undefined) {
            if (dto.phoneLoginEnabled) {
                if (!user.phone) {
                    throw new common_2.NotFoundException('User has no phone number');
                }
                user.phoneVerifiedAt = user.phoneVerifiedAt || new Date();
                await user.findOrCreateIdentity(auth_constants_1.PHONE_AUTH_PROVIDER, user.phone);
            }
            else {
                user.phoneVerifiedAt = null;
                const phoneIdentity = user.identities?.find(i => i.provider === auth_constants_1.PHONE_AUTH_PROVIDER);
                if (phoneIdentity) {
                    await phoneIdentity.remove();
                }
            }
        }
        if (dto.password) {
            await user.setPassword(dto.password);
        }
        await user.save();
        const config = this.authConfigService.getConfig();
        const tenantEnabled = config.tenant?.enabled === true;
        const tenantMode = config.tenant?.mode ?? nest_auth_contracts_1.TenantModeEnum.ISOLATED;
        if (tenantEnabled && tenantMode === nest_auth_contracts_1.TenantModeEnum.SHARED && dto.tenantIds !== undefined) {
            const resolvedIds = await this.resolveTenantIds(dto.tenantIds);
            await this.adminUserManagement.syncUserAccesses(id, resolvedIds);
        }
        if (!tenantEnabled && dto.roleIds !== undefined) {
            const userAccess = await user.getUserAccess(null, true);
            await userAccess.assignRoles(dto.roleIds ?? []);
        }
        if (dto.tenantRoles?.length) {
            for (const tr of dto.tenantRoles) {
                const resolved = await this.resolveTenantIds([tr.tenantId]);
                if (resolved.length) {
                    await this.users.setUserAccessRoles(id, tr.tenantId, tr.roleIds ?? []);
                }
            }
        }
        const reloadedUser = await this.users.getUserById(user.id, {
            relations: [
                'userAccesses',
                'userAccesses.tenant',
                'userAccesses.roles',
                'userAccesses.roles.rolePermissions',
                'userAccesses.roles.rolePermissions.permission',
            ],
        });
        const safeUser = await this.toSafeUser(reloadedUser);
        return { user: safeUser };
    }
    async deleteTotpDevice(id, deviceId) {
        const user = await this.users.getUserById(id);
        if (!user) {
            throw new common_2.NotFoundException('User not found');
        }
        const device = await this.mfaSecretRepository.findOne({
            where: { id: deviceId, userId: user.id },
        });
        if (!device) {
            throw new common_2.NotFoundException('TOTP device not found');
        }
        await this.mfaSecretRepository.remove(device);
        return { message: 'TOTP device deleted successfully' };
    }
    async listSessions(id) {
        const user = await this.ensureUserExists(id);
        const sessions = await this.sessionManager.getUserSessions(user.id);
        return {
            data: sessions
                .sort((a, b) => {
                const aTime = a.lastActive?.getTime() ?? a.updatedAt?.getTime() ?? 0;
                const bTime = b.lastActive?.getTime() ?? b.updatedAt?.getTime() ?? 0;
                return bTime - aTime;
            })
                .map((session) => this.toSessionResponse(session)),
        };
    }
    async revokeSession(id, sessionId) {
        const user = await this.ensureUserExists(id);
        const sessions = await this.sessionManager.getUserSessions(user.id);
        try {
            const session = sessions.find((s) => s.id === sessionId);
            if (!session) {
                throw new common_2.NotFoundException('Session not found for this user');
            }
            await this.sessionManager.revokeSession(session.id, 'admin');
            return { message: 'Session revoked successfully' };
        }
        catch (error) {
            throw new common_2.NotFoundException('Session not found for this user');
        }
    }
    async revokeAllSessions(id) {
        const user = await this.ensureUserExists(id);
        await this.sessionManager.revokeAllUserSessions(user.id);
        return { message: 'All sessions revoked successfully' };
    }
    async deleteUser(id) {
        await this.users.deleteUser(id);
        return { message: 'User removed' };
    }
    async toSafeUser(user) {
        if (!user) {
            return null;
        }
        let userAccesses = user.userAccesses;
        if (!userAccesses?.length) {
            userAccesses = await this.userAccessRepository.find({
                where: { userId: user.id },
                relations: ['tenant', 'roles', 'roles.rolePermissions', 'roles.rolePermissions.permission'],
            });
        }
        const activeAccesses = (userAccesses?.filter((access) => access.isActive) ?? []).map((access) => ({
            id: access.id,
            userId: access.userId,
            tenantId: access.tenantId,
            tenant: access.tenant,
            roles: (access.roles ?? []).map((role) => (0, role_mapper_util_1.mapRoleToResponse)(role)),
            isActive: access.isActive,
            isDefault: access.isDefault,
            status: access.status,
            metadata: access.metadata ?? {},
            createdAt: access.createdAt,
            updatedAt: access.updatedAt,
        }));
        return {
            id: user.id,
            email: user.email,
            phone: user.phone,
            userAccesses: activeAccesses,
            isActive: user.isActive,
            emailVerifiedAt: user.emailVerifiedAt,
            phoneVerifiedAt: user.phoneVerifiedAt,
            metadata: user.metadata ?? {},
            createdAt: user.createdAt,
            updatedAt: user.updatedAt,
            isMfaEnabled: user.isMfaEnabled,
        };
    }
};
exports.AdminUsersController = AdminUsersController;
__decorate([
    (0, swagger_1.ApiOperation)({ summary: 'List users (paginated, cross-tenant; filter by status/tenant/role/search)' }),
    (0, common_1.Get)(),
    __param(0, (0, common_1.Query)('page')),
    __param(1, (0, common_1.Query)('limit')),
    __param(2, (0, common_1.Query)('search')),
    __param(3, (0, common_1.Query)('status')),
    __param(4, (0, common_1.Query)('tenantId')),
    __param(5, (0, common_1.Query)('roleName')),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String, String, String, String, String]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "listUsers", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: 'Create a user' }),
    (0, common_1.Post)(),
    __param(0, (0, common_1.Body)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [admin_user_dto_1.AdminCreateUserDto]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "createUser", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: 'Get a user (with roles, sessions, identities)' }),
    (0, common_1.Get)(':id'),
    __param(0, (0, common_1.Param)('id')),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "getUser", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: 'Update a user' }),
    (0, common_1.Patch)(':id'),
    __param(0, (0, common_1.Param)('id')),
    __param(1, (0, common_1.Body)()),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, admin_user_dto_1.AdminUpdateUserDto]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "updateUser", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: "Remove a user's TOTP device" }),
    (0, common_1.Delete)(':id/totp-devices/:deviceId'),
    __param(0, (0, common_1.Param)('id')),
    __param(1, (0, common_1.Param)('deviceId')),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "deleteTotpDevice", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: "List a user's active sessions" }),
    (0, common_1.Get)(':id/sessions'),
    __param(0, (0, common_1.Param)('id')),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "listSessions", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: 'Revoke a single user session' }),
    (0, common_1.Delete)(':id/sessions/:sessionId'),
    __param(0, (0, common_1.Param)('id')),
    __param(1, (0, common_1.Param)('sessionId')),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String, String]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "revokeSession", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: "Revoke all of a user's sessions" }),
    (0, common_1.Delete)(':id/sessions'),
    __param(0, (0, common_1.Param)('id')),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "revokeAllSessions", null);
__decorate([
    (0, swagger_1.ApiOperation)({ summary: 'Delete a user' }),
    (0, common_1.Delete)(':id'),
    __param(0, (0, common_1.Param)('id')),
    __metadata("design:type", Function),
    __metadata("design:paramtypes", [String]),
    __metadata("design:returntype", Promise)
], AdminUsersController.prototype, "deleteUser", null);
exports.AdminUsersController = AdminUsersController = __decorate([
    (0, common_1.Controller)('api/users'),
    (0, common_1.UseFilters)(auth_exception_filter_1.AuthExceptionFilter),
    (0, common_1.UseGuards)(admin_session_guard_1.AdminSessionGuard),
    (0, swagger_1.ApiTags)('Admin · Users'),
    (0, swagger_1.ApiCookieAuth)('admin-session'),
    (0, core_1.ApiUnauthorized)('Admin session missing or invalid.'),
    (0, core_1.ApiForbidden)(),
    (0, core_1.ApiValidationError)(),
    (0, core_1.ApiNotFoundError)('User not found.'),
    (0, core_1.Public)(),
    __param(6, (0, typeorm_1.InjectRepository)(mfa_secret_entity_1.NestAuthMFASecret)),
    __param(7, (0, typeorm_1.InjectRepository)(user_access_entity_1.NestAuthUserAccess)),
    __param(8, (0, typeorm_1.InjectRepository)(trusted_device_entity_1.NestAuthTrustedDevice)),
    __metadata("design:paramtypes", [user_service_1.UserService,
        admin_user_management_service_1.AdminUserManagementService,
        tenant_service_1.TenantService,
        auth_config_service_1.AuthConfigService,
        mfa_service_1.MfaService,
        session_manager_service_1.SessionManagerService,
        typeorm_2.Repository,
        typeorm_2.Repository,
        typeorm_2.Repository])
], AdminUsersController);
//# sourceMappingURL=admin-users.controller.js.map