import { verifyPassword } from '../auth/password.js';
/** Check whether a sensitive action requires re-authentication. */
export function requiresReauth(context, config) {
    if (!config.requiredForActions.includes(context.action))
        return false;
    const elapsed = (Date.now() - context.lastAuthAt.getTime()) / 1000;
    return elapsed > config.maxAgeSeconds;
}
/** Verify re-authentication credentials (password or TOTP). */
export async function verifyReauth(userId, credential, method, db) {
    if (!db) {
        const { getDB } = await import('../db.js');
        db = getDB();
    }
    if (method === 'totp') {
        const user = await db.user.findUnique({
            where: { id: userId },
            select: { totpEnabled: true, totpSecret: true, isActive: true },
        });
        if (!user || !user.isActive || !user.totpEnabled || !user.totpSecret) {
            return false;
        }
        const { verifyTOTP } = await import('../auth/totp.js');
        return verifyTOTP(credential, user.totpSecret);
    }
    const user = await db.user.findUnique({
        where: { id: userId },
        select: { passwordHash: true, isActive: true },
    });
    if (!user || !user.isActive || !user.passwordHash) {
        return false;
    }
    return verifyPassword(credential, user.passwordHash);
}
/** Default configuration for sensitive actions requiring re-auth. */
export const DEFAULT_REAUTH_CONFIG = {
    maxAgeSeconds: 300,
    requiredForActions: [
        'delete_user',
        'change_user_role',
        'change_settings',
        'export_data',
        'reset_password_other',
    ],
};
//# sourceMappingURL=reauth.js.map