import { GrantAuthorization } from './grant-authorization.js';
import { DwnError, DwnErrorCode } from './dwn-error.js';
export class ProtocolsGrantAuthorization {
    /**
     * Authorizes the given ProtocolsConfigure in the scope of the DID given.
     */
    static async authorizeConfigure(input) {
        const { protocolsConfigureMessage, expectedGrantor, expectedGrantee, permissionGrant, validationStateReader } = input;
        await GrantAuthorization.performBaseValidation({
            incomingMessage: protocolsConfigureMessage,
            expectedGrantor,
            expectedGrantee,
            permissionGrant,
            validationStateReader
        });
        ProtocolsGrantAuthorization.verifyScope(protocolsConfigureMessage, permissionGrant.scope);
    }
    /**
     * Authorizes the scope of a permission grant for a ProtocolsQuery message.
     * @param validationStateReader Used to check if the grant has been revoked.
     */
    static async authorizeQuery(input) {
        const { expectedGrantee, expectedGrantor, incomingMessage, permissionGrant, validationStateReader } = input;
        await GrantAuthorization.performBaseValidation({
            incomingMessage: incomingMessage,
            expectedGrantor,
            expectedGrantee,
            permissionGrant,
            validationStateReader
        });
        // If the grant specifies a protocol, the query must specify the same protocol.
        const permissionScope = permissionGrant.scope;
        const protocolInGrant = permissionScope.protocol;
        const protocolInMessage = incomingMessage.descriptor.filter?.protocol;
        if (protocolInGrant !== undefined && protocolInMessage !== protocolInGrant) {
            throw new DwnError(DwnErrorCode.ProtocolsGrantAuthorizationQueryProtocolScopeMismatch, `Grant protocol scope ${protocolInGrant} does not match protocol in message ${protocolInMessage}`);
        }
    }
    /**
     * Verifies a ProtocolsConfigure against the scope of the given grant.
     */
    static verifyScope(protocolsConfigureMessage, grantScope) {
        // if the grant scope does not specify a protocol, then it is am unrestricted grant
        if (grantScope.protocol === undefined) {
            return;
        }
        if (grantScope.protocol !== protocolsConfigureMessage.descriptor.definition.protocol) {
            throw new DwnError(DwnErrorCode.ProtocolsGrantAuthorizationScopeProtocolMismatch, `Grant scope specifies different protocol than what appears in the configure message.`);
        }
    }
}
//# sourceMappingURL=protocols-grant-authorization.js.map