

import { KeyManagementError } from "../../error/KeyManagementError.mjs";
import { TypedArrayEncoder } from "../../../../utils/TypedArrayEncoder.mjs";
import "../../../../utils/index.mjs";
import { getJwkHumanDescription } from "../humanDescription.mjs";

//#region src/modules/kms/jwk/alg/encryption.ts
function supportedEncryptionAlgsForKey(jwk) {
	const algs = [];
	if (jwk.kty === "oct") {
		const keyBits = TypedArrayEncoder.fromBase64(jwk.k).length * 8;
		if (keyBits === 256) algs.push("A128CBC-HS256");
		if (keyBits === 384) algs.push("A192CBC-HS384");
		if (keyBits === 512) algs.push("A256CBC-HS512");
		if (keyBits === 128) algs.push("A128GCM", "A128CBC", "A128KW");
		if (keyBits === 192) algs.push("A192GCM", "A192KW");
		if (keyBits === 256) algs.push("A256GCM", "A256CBC", "A256KW", "C20P", "XC20P");
	}
	return algs;
}
/**
* Get the allowed content encryption algs for a key. If takes all the known supported
* algs and will filter these based on the optional `alg` key in the JWK.
*
* This does not handle the intended key `use` and `key_ops`.
*/
function allowedEncryptionAlgsForKey(jwk) {
	const supportedAlgs = supportedEncryptionAlgsForKey(jwk);
	const allowedAlg = jwk.alg;
	return !allowedAlg ? supportedAlgs : allowedAlg && supportedAlgs.includes(allowedAlg) ? [allowedAlg] : [];
}
function assertAllowedEncryptionAlgForKey(jwk, algorithm) {
	const allowedAlgs = allowedEncryptionAlgsForKey(jwk);
	if (!allowedAlgs.includes(algorithm)) {
		const allowedAlgsText = allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(", ")}` : "";
		throw new KeyManagementError(`${getJwkHumanDescription(jwk)} cannot be used with algorithm '${algorithm}' for content encryption or decryption.${allowedAlgsText}`);
	}
}

//#endregion
export { allowedEncryptionAlgsForKey, assertAllowedEncryptionAlgForKey, supportedEncryptionAlgsForKey };
//# sourceMappingURL=encryption.mjs.map