export function summarizeUsers(rows) {
    let totalAdmins = 0;
    let withMfa = 0;
    let adminsWithoutMfa = 0;
    let withoutMfa = 0;
    let inactive = 0;
    for (const u of rows) {
        if (!u.isActive)
            inactive++;
        if (!u.totpEnabled)
            withoutMfa++;
        const isAdmin = u.role === 'ADMIN';
        if (isAdmin) {
            totalAdmins++;
            if (u.totpEnabled)
                withMfa++;
            else if (u.isActive)
                adminsWithoutMfa++;
        }
    }
    return {
        totalUsers: rows.length,
        totalAdmins,
        withMfa,
        withoutMfa,
        adminsWithoutMfa,
        inactive,
    };
}
const STALE_MS = 90 * 24 * 60 * 60 * 1000;
/** A key is "broad" if it carries the admin scope (full control). */
function isBroadScope(scopes) {
    if (!scopes || typeof scopes !== 'object')
        return false;
    return scopes.admin === true;
}
function toTime(v) {
    if (!v)
        return null;
    const t = v instanceof Date ? v.getTime() : new Date(v).getTime();
    return Number.isFinite(t) ? t : null;
}
export function summarizeApiKeys(rows, now = Date.now()) {
    let active = 0;
    let withoutExpiration = 0;
    let broadScope = 0;
    let staleUnused90d = 0;
    for (const k of rows) {
        if (k.revokedAt)
            continue;
        const exp = toTime(k.expiresAt);
        if (exp !== null && exp <= now)
            continue; // expired ⇒ not active
        active++;
        if (exp === null)
            withoutExpiration++;
        if (isBroadScope(k.scopes))
            broadScope++;
        const used = toTime(k.lastUsedAt);
        if (used !== null && now - used > STALE_MS)
            staleUnused90d++;
    }
    return { active, withoutExpiration, broadScope, staleUnused90d };
}
//# sourceMappingURL=summaries.js.map