"use strict";
Object.defineProperty(exports, "__esModule", {
    value: true
});
function _export(target, all) {
    for(var name in all)Object.defineProperty(target, name, {
        enumerable: true,
        get: all[name]
    });
}
_export(exports, {
    authenticate: function() {
        return authenticate;
    },
    authorizePermission: function() {
        return authorizePermission;
    },
    authorizeRoles: function() {
        return authorizeRoles;
    },
    withPermission: function() {
        return withPermission;
    }
});
const _awilixexpress = require("awilix-express");
const _runtimeexceptions = require("../exceptions/runtime.exceptions");
const _authorizationconstants = require("../constants/authorization.constants");
const authenticate = ()=>(0, _awilixexpress.inject)(({ settingsStore, authService, loggerFactory })=>async (req, res, next)=>{
            const logger = loggerFactory("Middleware:authenticate");
            const isLoginRequired = await settingsStore.getLoginRequired();
            if (!isLoginRequired) {
                return next();
            }
            if (req.user?.needsPasswordChange) {
                throw new _runtimeexceptions.AuthenticationError("Password change required", _authorizationconstants.AUTH_ERROR_REASON.PasswordChangeRequired);
            }
            const bearer = req.headers.authorization?.replace("Bearer ", "") || undefined;
            const isJwtBlacklisted = authService.isJwtTokenBlacklisted(bearer);
            if (!!bearer?.length && isJwtBlacklisted) {
                throw new _runtimeexceptions.AuthenticationError("Not authenticated", _authorizationconstants.AUTH_ERROR_REASON.LoginRequired);
            }
            if (req.isAuthenticated()) {
                return next();
            }
            logger.log(`Not authenticated for route: ${req.originalUrl}`);
            throw new _runtimeexceptions.AuthenticationError("Not authenticated", _authorizationconstants.AUTH_ERROR_REASON.InvalidOrExpiredAuthToken);
        });
function authorizePermission(permission) {
    return (0, _awilixexpress.inject)(({ permissionService, roleService })=>async (req, res, next)=>{
            const userRoles = req.roles;
            if (!userRoles?.length) {
                throw new _runtimeexceptions.AuthorizationError({
                    permissions: [
                        permission
                    ]
                });
            }
            const assignedPermissions = roleService.getRolesPermissions(userRoles);
            if (!permissionService.authorizePermission(permission, assignedPermissions)) {
                throw new _runtimeexceptions.AuthorizationError({
                    permissions: [
                        permission
                    ]
                });
            }
            next();
        });
}
const authorizeRoles = (roles, subset = true)=>(0, _awilixexpress.inject)(({ roleService })=>async (req, res, next)=>{
            if (!roleService.authorizeRoles(roles, req.roles, subset)) {
                throw new _runtimeexceptions.AuthorizationError({
                    roles
                });
            }
            next();
        });
function withPermission(permission) {
    return {
        before: [
            authorizePermission(permission)
        ]
    };
}

//# sourceMappingURL=authenticate.js.map