// @bun
var{defineProperty:J,getOwnPropertyNames:N,getOwnPropertyDescriptor:O}=Object,Q=Object.prototype.hasOwnProperty;function S(j){return this[j]}var Y=(j)=>{var q=(L??=new WeakMap).get(j),z;if(q)return q;if(q=J({},"__esModule",{value:!0}),j&&typeof j==="object"||typeof j==="function"){for(var B of N(j))if(!Q.call(q,B))J(q,B,{get:S.bind(j,B),enumerable:!(z=O(j,B))||z.enumerable})}return L.set(j,q),q},L;var T=(j)=>j;function W(j,q){this[j]=T.bind(null,q)}var Z=(j,q)=>{for(var z in q)J(j,z,{get:q[z],enumerable:!0,configurable:!0,set:W.bind(q,z)})};var _=(j,q)=>()=>(j&&(q=j(j=0)),q);class K extends Error{violationType;details;constructor(j,q){let z=X(j,q);super(z);this.name="PolicyViolationError",this.violationType=j,this.details=q}}function X(j,q){let z=q.operation?`Policy violation for "${q.operation}": `:"Policy violation: ";switch(j){case"missing_role":return`${z}Missing required role "${q.requiredRole}"`;case"missing_permission":return`${z}Missing required permission "${q.requiredPermission}"`;case"missing_attribute":return`${z}Missing or invalid attribute "${q.requiredAttribute?.key}"`;case"rate_limit_exceeded":return`${z}Rate limit exceeded for key "${q.rateLimitKey}"`;case"consent_required":return`${z}Consent required: ${q.consentIds?.join(", ")}`;case"access_denied":return`${z}${q.reason??"Access denied"}`}}class F{user;roles;permissions;rateLimitStates=new Map;rateLimitConfigs;auditHandler;constructor(j,q={}){this.user=j,this.roles=new Set(j.roles),this.permissions=new Set(j.permissions),this.rateLimitConfigs=q.rateLimits??{},this.auditHandler=q.auditHandler}hasRole(j){return this.roles.has(j)}hasAnyRole(j){return j.some((q)=>this.roles.has(q))}hasAllRoles(j){return j.every((q)=>this.roles.has(q))}requireRole(j){if(!this.hasRole(j))throw new K("missing_role",{requiredRole:j})}hasPermission(j){return this.permissions.has(j)}hasAnyPermission(j){return j.some((q)=>this.permissions.has(q))}hasAllPermissions(j){return j.every((q)=>this.permissions.has(q))}requirePermission(j){if(!this.hasPermission(j))throw new K("missing_permission",{requiredPermission:j})}getAttribute(j){return this.user.attributes[j]}checkAttribute(j,q){return this.user.attributes[j]===q}checkAttributeOneOf(j,q){return q.includes(this.user.attributes[j])}checkRateLimit(j){let q=this.rateLimitConfigs[j];if(!q)return{allowed:!0,remaining:1/0};let z=Date.now(),B=this.rateLimitStates.get(j);if(!B||z-B.windowStart>=q.windowMs)return{allowed:!0,remaining:q.limit};let D=Math.max(0,q.limit-B.count);if(D<=0){let G=new Date(B.windowStart+q.windowMs),H=B.windowStart+q.windowMs-z;return{allowed:!1,remaining:0,resetAt:G,retryAfterMs:H}}return{allowed:!0,remaining:D}}consumeRateLimit(j,q=1){let z=this.rateLimitConfigs[j];if(!z)return{allowed:!0,remaining:1/0};let B=Date.now(),D=this.rateLimitStates.get(j);if(!D||B-D.windowStart>=z.windowMs)D={key:j,count:0,windowStart:B,windowMs:z.windowMs,limit:z.limit};if(D.count+q>z.limit){let G=new Date(D.windowStart+z.windowMs),H=D.windowStart+z.windowMs-B;return this.rateLimitStates.set(j,D),{allowed:!1,remaining:Math.max(0,z.limit-D.count),resetAt:G,retryAfterMs:H}}return D.count+=q,this.rateLimitStates.set(j,D),{allowed:!0,remaining:Math.max(0,z.limit-D.count)}}auditAccess(j,q,z){if(!this.auditHandler)return;let B={timestamp:new Date,operation:j,result:q,reason:z,userId:this.user.id,tenantId:this.user.tenantId,attributes:this.user.attributes};Promise.resolve(this.auditHandler(B)).catch(()=>{})}}function b(j,q){return new F(j,q)}function h(j){return new F({id:"anonymous",roles:[],permissions:[],attributes:{}},j)}function v(j,q,z){return new F({id:"system",roles:j,permissions:q,attributes:{bypass:!0}},z)}export{b as createPolicyContext,v as createBypassPolicyContext,h as createAnonymousPolicyContext,K as PolicyViolationError};
