import { projectsDb } from '../../../modules/database/index.js';
import { AppError, normalizeProjectPath } from '../../../shared/utils.js';
const defaultDependencies = {
    getProjectPath: projectsDb.getProjectPath.bind(projectsDb),
};
function coerceNumericUserId(userId) {
    if (userId === null || userId === undefined) {
        throw new AppError('Authenticated user is required', {
            code: 'AUTHENTICATION_REQUIRED',
            statusCode: 401,
        });
    }
    const numericId = typeof userId === 'number' ? userId : Number.parseInt(String(userId), 10);
    if (Number.isNaN(numericId)) {
        throw new AppError('Authenticated user is required', {
            code: 'AUTHENTICATION_REQUIRED',
            statusCode: 401,
        });
    }
    return numericId;
}
/**
 * Confirms that `requestedPath` is a project registered to `userId`, and
 * returns its canonical (normalized) form.
 *
 * Use this anywhere the server is about to act on a path supplied over the
 * wire — spawn a CLI, register a clone target, etc. — so a user with a valid
 * session cannot pivot to another user's project simply by knowing its path.
 */
export function assertUserOwnsProjectPath(userId, requestedPath, dependencies = defaultDependencies) {
    const numericUserId = coerceNumericUserId(userId);
    if (typeof requestedPath !== 'string' || requestedPath.trim().length === 0) {
        throw new AppError('A project path is required', {
            code: 'PROJECT_PATH_REQUIRED',
            statusCode: 400,
        });
    }
    const normalized = normalizeProjectPath(requestedPath);
    if (!normalized) {
        throw new AppError('A project path is required', {
            code: 'PROJECT_PATH_REQUIRED',
            statusCode: 400,
        });
    }
    const project = dependencies.getProjectPath(numericUserId, normalized);
    if (!project) {
        throw new AppError('The requested path is not a project owned by the authenticated user', {
            code: 'PROJECT_NOT_OWNED_BY_USER',
            statusCode: 403,
        });
    }
    return normalized;
}
//# sourceMappingURL=project-authorization.service.js.map