"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.OPERATION_PERMISSION_GROUPS = void 0;
exports.validateOperations = validateOperations;
exports.expandOperationsPerms = expandOperationsPerms;
const hdbTerms_ts_1 = require("./hdbTerms.js");
/**
 * Predefined operation permission groups for use with `operations` role permissions.
 * Group names can be included in the `operations` array alongside individual operation names.
 */
exports.OPERATION_PERMISSION_GROUPS = {
    /**
     * Read-only data operations: searches, SQL (DML type further enforced by table CRUD perms),
     * schema describes, and user/analytics reads. Does NOT include admin reads
     * (get_configuration, logs, component views) — add those explicitly alongside this group
     * when elevated admin visibility is needed.
     */
    read_only: [
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_CONDITIONS,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_HASH,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_ID,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_VALUE,
        hdbTerms_ts_1.OPERATIONS_ENUM.SQL,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_ALL,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_SCHEMA,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_DATABASE,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_TABLE,
        hdbTerms_ts_1.OPERATIONS_ENUM.USER_INFO,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_JOB,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_ANALYTICS,
        hdbTerms_ts_1.OPERATIONS_ENUM.LIST_METRICS,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_METRIC,
    ],
    /**
     * Elevated read-only access to server configuration, logs, and component views.
     * All ops here are SU-only and granted via the operations SU bypass.
     * Combine with `read_only` for a full studio/dashboard read role:
     * `operations: ['read_only', 'admin_read']`
     */
    admin_read: [
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_CONFIGURATION,
        hdbTerms_ts_1.OPERATIONS_ENUM.READ_LOG,
        hdbTerms_ts_1.OPERATIONS_ENUM.READ_AUDIT_LOG,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_CUSTOM_FUNCTIONS,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_CUSTOM_FUNCTION,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_COMPONENTS,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_COMPONENT_FILE,
    ],
    /**
     * Everything in `read_only` plus full data manipulation (insert, update, upsert, delete)
     * and bulk load. Does NOT include schema DDL (create_attribute), user/role management,
     * or admin reads (get_configuration, logs). Add those explicitly when needed.
     */
    standard_user: [
        // All read_only ops
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_CONDITIONS,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_HASH,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_ID,
        hdbTerms_ts_1.OPERATIONS_ENUM.SEARCH_BY_VALUE,
        hdbTerms_ts_1.OPERATIONS_ENUM.SQL,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_ALL,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_SCHEMA,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_DATABASE,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_TABLE,
        hdbTerms_ts_1.OPERATIONS_ENUM.USER_INFO,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_JOB,
        hdbTerms_ts_1.OPERATIONS_ENUM.GET_ANALYTICS,
        hdbTerms_ts_1.OPERATIONS_ENUM.LIST_METRICS,
        hdbTerms_ts_1.OPERATIONS_ENUM.DESCRIBE_METRIC,
        // Data manipulation
        hdbTerms_ts_1.OPERATIONS_ENUM.INSERT,
        hdbTerms_ts_1.OPERATIONS_ENUM.UPDATE,
        hdbTerms_ts_1.OPERATIONS_ENUM.UPSERT,
        hdbTerms_ts_1.OPERATIONS_ENUM.DELETE,
        // Bulk load
        hdbTerms_ts_1.OPERATIONS_ENUM.CSV_DATA_LOAD,
        hdbTerms_ts_1.OPERATIONS_ENUM.CSV_FILE_LOAD,
        hdbTerms_ts_1.OPERATIONS_ENUM.CSV_URL_LOAD,
        hdbTerms_ts_1.OPERATIONS_ENUM.IMPORT_FROM_S3,
    ],
};
const validOps = new Set(Object.values(hdbTerms_ts_1.OPERATIONS_ENUM));
const validGroups = new Set(Object.keys(exports.OPERATION_PERMISSION_GROUPS));
/**
 * Validates that every entry in an operations array is a known operation name or group name.
 * Returns the first invalid entry, or null if all entries are valid.
 */
function validateOperations(operations) {
    for (const op of operations) {
        if (typeof op !== 'string' || (!validOps.has(op) && !validGroups.has(op))) {
            return String(op);
        }
    }
    return null;
}
/**
 * Expands an operations array into a Set of individual operation names,
 * resolving group names (e.g. 'read_only') to their member operations.
 */
function expandOperationsPerms(operations) {
    const allowedOps = new Set();
    for (const item of operations) {
        const group = exports.OPERATION_PERMISSION_GROUPS[item];
        if (group) {
            for (const op of group)
                allowedOps.add(op);
        }
        else {
            allowedOps.add(item);
        }
    }
    return allowedOps;
}
//# sourceMappingURL=operationPermissions.js.map