"use strict";
/*
 *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *  SPDX-License-Identifier: Apache-2.0
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.ProjectEnvService = void 0;
const swb_app_1 = require("@aws/swb-app");
const projectStatus_1 = require("@aws/workbench-core-accounts/lib/constants/projectStatus");
const workbench_core_authorization_1 = require("@aws/workbench-core-authorization");
const roleUtils_1 = require("../utils/roleUtils");
class ProjectEnvService {
    constructor(dynamicAuthorizationService, envService, projectService) {
        this._dynamicAuthorizationService = dynamicAuthorizationService;
        this._envService = envService;
        this._projectService = projectService;
    }
    async createEnvironment(params, authenticatedUser) {
        const projectId = params.projectId;
        const project = await this._projectService.getProject({ projectId });
        if (project.status === projectStatus_1.ProjectStatus.DELETED) {
            throw new swb_app_1.ProjectDeletedError(`Project ${projectId} was deleted`);
        }
        const env = await this._envService.createEnvironment(Object.assign(Object.assign({}, params), { cidr: '', outputs: [] }), authenticatedUser);
        const projectAdmin = (0, roleUtils_1.getProjectAdminRole)(projectId);
        const projectResearcher = (0, roleUtils_1.getResearcherRole)(projectId);
        await this._addAuthZPermissionsForEnv(authenticatedUser, "SWB_ENVIRONMENT" /* SwbAuthZSubject.SWB_ENVIRONMENT */, env.id, [projectAdmin, projectResearcher], ['READ', 'UPDATE', 'DELETE'], projectId);
        await this._addAuthZPermissionsForEnv(authenticatedUser, "SWB_ENVIRONMENT_CONNECTION" /* SwbAuthZSubject.SWB_ENVIRONMENT_CONNECTION */, env.id, [projectAdmin, projectResearcher], ['READ'], projectId);
        return env;
    }
    async getEnvironment(projectId, envId, includeMetadata = false) {
        await this._projectService.getProject({ projectId: projectId });
        return this._envService.getEnvironment(envId, includeMetadata);
    }
    async listProjectEnvs(projectId, pageSize, paginationToken) {
        await this._projectService.getProject({ projectId: projectId });
        return this._envService.listEnvironmentsByProject({ projectId: projectId, pageSize, paginationToken });
    }
    async updateEnvironment(projectId, envId, updatedValues) {
        await this._projectService.getProject({ projectId: projectId });
        return this._envService.updateEnvironment(envId, updatedValues);
    }
    async _addAuthZPermissionsForEnv(authenticatedUser, subjectType, subjectId, roles, actions, projectId) {
        const partialIdentityPermission = {
            action: undefined,
            effect: 'ALLOW',
            identityId: undefined,
            identityType: 'GROUP',
            subjectId: subjectId,
            subjectType: subjectType,
            conditions: {
                projectId: { $eq: projectId }
            }
        };
        const identityPermissions = [];
        for (const role of roles) {
            for (const action of actions) {
                const identityPermission = workbench_core_authorization_1.IdentityPermissionParser.parse(Object.assign(Object.assign({}, partialIdentityPermission), { identityId: role, action }));
                identityPermissions.push(identityPermission);
            }
        }
        const createIdentityPermissionsRequest = workbench_core_authorization_1.CreateIdentityPermissionsRequestParser.parse({
            authenticatedUser,
            identityPermissions
        });
        await this._dynamicAuthorizationService.createIdentityPermissions(createIdentityPermissionsRequest);
    }
}
exports.ProjectEnvService = ProjectEnvService;
//# sourceMappingURL=projectEnvService.js.map