import { getClientIp } from '../../security/client-ip.js';
import { guardedDb } from '../guarded-db.js';
import { importAIPlugin, json, internalError, requireAuth, requireAdminScope, } from '../route-helpers.js';
export function registerSecurityCenterRoutes(router) {
    const db = guardedDb;
    // ---------------------------------------------------------------------------
    // Security Center
    //   GET  /security                       — computed posture + summaries
    //   PUT  /security                        — persist enforced policy (lockout-safe)
    //   POST /security/sessions/revoke-all    — revoke the caller's other sessions
    // ---------------------------------------------------------------------------
    router.get('/security', async (request) => {
        try {
            const auth = await requireAuth(request);
            if (auth.error)
                return auth.error;
            const adminErr = requireAdminScope(auth.session);
            if (adminErr)
                return adminErr;
            const { getSecurityCenterData } = await import('../../security/center/gather.js');
            const data = await getSecurityCenterData({
                db: db(),
                userId: auth.session.userId,
                currentIp: getClientIp(request),
            });
            return json({ data });
        }
        catch (err) {
            return internalError(err, 'security GET');
        }
    });
    // Read-only AI status. The dashboard cannot configure AI — it is wired up
    // server-side via `aiPlugin({ provider, apiKey })` reading environment
    // variables. This endpoint just reports whether the plugin is installed and
    // a provider is configured so the admin UI can show an honest status instead
    // of a decorative key field. Never returns secret values.
    router.get('/ai/status', async (request) => {
        try {
            const auth = await requireAuth(request);
            if (auth.error)
                return auth.error;
            const adminErr = requireAdminScope(auth.session);
            if (adminErr)
                return adminErr;
            let installed = false;
            let configured = false;
            try {
                const aiMod = await importAIPlugin();
                installed = true;
                if (typeof aiMod?.getAIProvider === 'function') {
                    configured = aiMod.getAIProvider() != null;
                }
            }
            catch {
                installed = false;
            }
            // Best-effort provider hint from the environment. We only expose which
            // provider env var is present, never the key value itself.
            const provider = process.env.ANTHROPIC_API_KEY
                ? 'anthropic'
                : process.env.OPENAI_API_KEY
                    ? 'openai'
                    : null;
            return json({ data: { installed, configured, provider } });
        }
        catch (err) {
            return internalError(err, 'ai status');
        }
    });
}
//# sourceMappingURL=security-center.js.map