"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getUserByOAuthProvider = exports.deleteOAuthConnection = exports.listOAuthConnections = exports.getFreshAccessToken = exports.getOAuthToken = exports.upsertOAuthToken = exports.listProviders = exports.getProvider = exports.registerProvider = exports.consumeOAuthState = exports.createOAuthState = exports.setEncryptionKey = exports.getEncryptionKey = exports.decrypt = exports.encrypt = void 0;
exports.initializeOAuth = initializeOAuth;
const crypto_1 = require("./crypto");
const providers_1 = require("./providers");
const logger_1 = require("../../lib/logger");
var crypto_2 = require("./crypto");
Object.defineProperty(exports, "encrypt", { enumerable: true, get: function () { return crypto_2.encrypt; } });
Object.defineProperty(exports, "decrypt", { enumerable: true, get: function () { return crypto_2.decrypt; } });
Object.defineProperty(exports, "getEncryptionKey", { enumerable: true, get: function () { return crypto_2.getEncryptionKey; } });
Object.defineProperty(exports, "setEncryptionKey", { enumerable: true, get: function () { return crypto_2.setEncryptionKey; } });
var state_1 = require("./state");
Object.defineProperty(exports, "createOAuthState", { enumerable: true, get: function () { return state_1.createOAuthState; } });
Object.defineProperty(exports, "consumeOAuthState", { enumerable: true, get: function () { return state_1.consumeOAuthState; } });
var providers_2 = require("./providers");
Object.defineProperty(exports, "registerProvider", { enumerable: true, get: function () { return providers_2.registerProvider; } });
Object.defineProperty(exports, "getProvider", { enumerable: true, get: function () { return providers_2.getProvider; } });
Object.defineProperty(exports, "listProviders", { enumerable: true, get: function () { return providers_2.listProviders; } });
var db_1 = require("./db");
Object.defineProperty(exports, "upsertOAuthToken", { enumerable: true, get: function () { return db_1.upsertOAuthToken; } });
Object.defineProperty(exports, "getOAuthToken", { enumerable: true, get: function () { return db_1.getOAuthToken; } });
Object.defineProperty(exports, "getFreshAccessToken", { enumerable: true, get: function () { return db_1.getFreshAccessToken; } });
Object.defineProperty(exports, "listOAuthConnections", { enumerable: true, get: function () { return db_1.listOAuthConnections; } });
Object.defineProperty(exports, "deleteOAuthConnection", { enumerable: true, get: function () { return db_1.deleteOAuthConnection; } });
Object.defineProperty(exports, "getUserByOAuthProvider", { enumerable: true, get: function () { return db_1.getUserByOAuthProvider; } });
/** Well-known env var patterns for auto-detecting OAuth providers. */
const ENV_PROVIDERS = [
    { provider: 'google', idVar: 'OAUTH_GOOGLE_CLIENT_ID', secretVar: 'OAUTH_GOOGLE_CLIENT_SECRET' },
    { provider: 'github', idVar: 'OAUTH_GITHUB_CLIENT_ID', secretVar: 'OAUTH_GITHUB_CLIENT_SECRET' },
    { provider: 'microsoft', idVar: 'OAUTH_MICROSOFT_CLIENT_ID', secretVar: 'OAUTH_MICROSOFT_CLIENT_SECRET' },
    { provider: 'mock', idVar: 'OAUTH_MOCK_CLIENT_ID', secretVar: 'OAUTH_MOCK_CLIENT_SECRET' },
];
/**
 * Credential-only providers that register unconditionally.
 * These don't use real OAuth (no clientId/clientSecret needed) —
 * they store user-provided API keys via a dashboard form.
 */
const CREDENTIAL_PROVIDERS = [
    { provider: 'anthropic', clientId: 'credential-flow', clientSecret: 'n/a', scopes: [] },
];
/**
 * Initialize the OAuth service.
 * Called from start.ts when auth.oauth is configured.
 * Also scans environment variables for provider credentials.
 */
function initializeOAuth(config) {
    // Set encryption key
    const encKey = config?.encryptionKey || process.env.OAUTH_ENCRYPTION_KEY;
    if (encKey) {
        (0, crypto_1.setEncryptionKey)(encKey);
    }
    // Register providers from startup config
    if (config?.providers) {
        for (const p of config.providers) {
            (0, providers_1.registerProvider)(p);
        }
    }
    // Auto-detect providers from environment variables
    const port = process.env.PORT || '3000';
    const baseUrl = process.env.BASE_URL || `http://localhost:${port}`;
    for (const { provider, idVar, secretVar } of ENV_PROVIDERS) {
        const clientId = process.env[idVar];
        const clientSecret = process.env[secretVar];
        if (clientId && clientSecret && !(0, providers_1.getProvider)(provider)) {
            const redirectUri = `${baseUrl}/api/auth/oauth/${provider}/callback`;
            (0, providers_1.registerProvider)({ provider, clientId, clientSecret, scopes: [], redirectUri });
        }
    }
    // Register built-in credential providers (API key paste flow, no real OAuth)
    for (const cfg of CREDENTIAL_PROVIDERS) {
        if (!(0, providers_1.getProvider)(cfg.provider)) {
            (0, providers_1.registerProvider)(cfg);
        }
    }
    const registered = (0, providers_1.listProviders)();
    if (registered.length > 0) {
        logger_1.loggerRegistry.info(`[oauth] initialized with ${registered.length} provider(s): ${registered.map((p) => p.provider).join(', ')}`);
    }
}
