"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.GatewayAuthorizerConfigSchema = exports.AuthorizerConfigSchema = exports.CustomJwtAuthorizerConfigSchema = exports.CustomClaimValidationSchema = exports.InboundTokenClaimValueTypeSchema = exports.ClaimMatchValueSchema = exports.ClaimMatchOperatorSchema = exports.RuntimeAuthorizerTypeSchema = exports.GatewayAuthorizerTypeSchema = void 0;
const zod_1 = require("zod");
// ============================================================================
// Shared Authorization Schemas
// ============================================================================
exports.GatewayAuthorizerTypeSchema = zod_1.z.enum(['NONE', 'AWS_IAM', 'CUSTOM_JWT']);
exports.RuntimeAuthorizerTypeSchema = zod_1.z.enum(['AWS_IAM', 'CUSTOM_JWT']);
/** OIDC well-known configuration endpoint suffix (per OpenID Connect Discovery 1.0 spec) */
const OIDC_WELL_KNOWN_SUFFIX = '/.well-known/openid-configuration';
/**
 * OIDC Discovery URL schema.
 * Must be a valid URL ending with the standard OIDC well-known endpoint.
 * @see https://openid.net/specs/openid-connect-discovery-1_0.html
 */
const OidcDiscoveryUrlSchema = zod_1.z
    .string()
    .url('Must be a valid URL')
    .refine(url => url.startsWith('https://'), {
    message: 'OIDC discovery URL must use HTTPS',
})
    .refine(url => url.endsWith(OIDC_WELL_KNOWN_SUFFIX), {
    message: `OIDC discovery URL must end with '${OIDC_WELL_KNOWN_SUFFIX}'`,
});
// ── Custom Claims Schemas (matches CFN CustomClaimValidationType) ──
// API-documented patterns (from ClaimMatchValueType and CustomClaimValidationType)
const MATCH_VALUE_PATTERN = /^[A-Za-z0-9_.-]+$/;
const CLAIM_NAME_PATTERN = /^[A-Za-z0-9_.:-]+$/;
// Server-side reserved claim names (not regex-documented; API rejects these at deploy time)
const RESERVED_CLAIM_NAMES = ['client_id'];
exports.ClaimMatchOperatorSchema = zod_1.z.enum(['EQUALS', 'CONTAINS', 'CONTAINS_ANY']);
exports.ClaimMatchValueSchema = zod_1.z
    .object({
    matchValueString: zod_1.z
        .string()
        .min(1)
        .max(255)
        .regex(MATCH_VALUE_PATTERN, 'Match value must match [A-Za-z0-9_.-]+')
        .optional(),
    matchValueStringList: zod_1.z
        .array(zod_1.z.string().min(1).max(255).regex(MATCH_VALUE_PATTERN, 'Each match value must match [A-Za-z0-9_.-]+'))
        .min(1)
        .max(255)
        .optional(),
})
    .refine(data => data.matchValueString !== undefined || data.matchValueStringList !== undefined, {
    message: 'Either matchValueString or matchValueStringList must be provided',
})
    .refine(data => !(data.matchValueString !== undefined && data.matchValueStringList !== undefined), {
    message: 'Only one of matchValueString or matchValueStringList may be provided',
});
exports.InboundTokenClaimValueTypeSchema = zod_1.z.enum(['STRING', 'STRING_ARRAY']);
exports.CustomClaimValidationSchema = zod_1.z
    .object({
    inboundTokenClaimName: zod_1.z
        .string()
        .min(1)
        .max(255)
        .regex(CLAIM_NAME_PATTERN, 'Claim name must match [A-Za-z0-9_.-:]+')
        .refine(name => !RESERVED_CLAIM_NAMES.includes(name), {
        message: `Claim name cannot be a reserved name (${RESERVED_CLAIM_NAMES.join(', ')})`,
    }),
    inboundTokenClaimValueType: exports.InboundTokenClaimValueTypeSchema,
    authorizingClaimMatchValue: zod_1.z.object({
        claimMatchOperator: exports.ClaimMatchOperatorSchema,
        claimMatchValue: exports.ClaimMatchValueSchema,
    }),
})
    .strict();
// ── Custom JWT Authorizer Configuration ──
/**
 * Custom JWT authorizer configuration.
 * Used when authorizerType is 'CUSTOM_JWT'.
 *
 * At least one of allowedAudience, allowedClients, allowedScopes, or customClaims
 * must be provided. Only discoveryUrl is unconditionally required.
 */
exports.CustomJwtAuthorizerConfigSchema = zod_1.z
    .object({
    /** OIDC discovery URL (e.g., https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/openid-configuration) */
    discoveryUrl: OidcDiscoveryUrlSchema,
    /** List of allowed audiences (typically client IDs) */
    allowedAudience: zod_1.z.array(zod_1.z.string().min(1)).optional(),
    /** List of allowed client IDs */
    allowedClients: zod_1.z.array(zod_1.z.string().min(1)).optional(),
    /** List of allowed scopes */
    allowedScopes: zod_1.z.array(zod_1.z.string().min(1)).optional(),
    /** Custom claim validations */
    customClaims: zod_1.z.array(exports.CustomClaimValidationSchema).min(1).optional(),
})
    .strict()
    .superRefine((data, ctx) => {
    const hasAudience = data.allowedAudience && data.allowedAudience.length > 0;
    const hasClients = data.allowedClients && data.allowedClients.length > 0;
    const hasScopes = data.allowedScopes && data.allowedScopes.length > 0;
    const hasClaims = data.customClaims && data.customClaims.length > 0;
    if (!hasAudience && !hasClients && !hasScopes && !hasClaims) {
        ctx.addIssue({
            code: zod_1.z.ZodIssueCode.custom,
            message: 'At least one of allowedAudience, allowedClients, allowedScopes, or customClaims must be provided',
        });
    }
});
/**
 * Resource-agnostic authorizer configuration container.
 * Used by both Gateway and Runtime resources.
 */
exports.AuthorizerConfigSchema = zod_1.z.object({
    customJwtAuthorizer: exports.CustomJwtAuthorizerConfigSchema.optional(),
});
/** @deprecated Use AuthorizerConfigSchema. Backwards-compatible alias for Gateway. */
exports.GatewayAuthorizerConfigSchema = exports.AuthorizerConfigSchema;
//# sourceMappingURL=auth.js.map