"use strict";
// ─── Shared queries (used by multiple modules) ──────────────────────────────
Object.defineProperty(exports, "__esModule", { value: true });
exports.IS_GROUP_ADMIN = exports.HAS_ROLE_TYPE = exports.HAS_ROLE = exports.DELETE_USER_ROLE = exports.UPSERT_USER_ROLE = exports.GET_ROLES_BY_USER_IDS = exports.DELETE_USER_BY_ID = exports.GET_USER_WITH_ROLES = exports.VERIFY_USER_BY_ID = exports.GET_USER_BY_ID = exports.INSERT_USER_ROLE_IGNORE = exports.GET_USER_BY_EMAIL = exports.INSERT_USER = exports.GET_USER_BY_EXTERNAL_ID = exports.GET_ROLES_BY_USER_ID = exports.ENSURE_ROLE_EXISTS = void 0;
/** Ensure a role name exists in the lt_roles lookup table (FK target). */
exports.ENSURE_ROLE_EXISTS = 'INSERT INTO lt_roles (role) VALUES ($1) ON CONFLICT DO NOTHING';
/** Fetch roles for a single user, ordered by creation time. */
exports.GET_ROLES_BY_USER_ID = 'SELECT role, type, created_at FROM lt_user_roles WHERE user_id = $1 ORDER BY created_at';
/** Fetch a user row by external_id. */
exports.GET_USER_BY_EXTERNAL_ID = 'SELECT * FROM lt_users WHERE external_id = $1';
// ─── User CRUD ───────────────────────────────────────────────────────────────
exports.INSERT_USER = `INSERT INTO lt_users (external_id, email, display_name, status, metadata, password_hash, oauth_provider, oauth_provider_id)
   VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
   RETURNING *`;
exports.GET_USER_BY_EMAIL = `SELECT * FROM lt_users WHERE email = $1 LIMIT 1`;
exports.INSERT_USER_ROLE_IGNORE = `INSERT INTO lt_user_roles (user_id, role, type) VALUES ($1, $2, $3)
   ON CONFLICT DO NOTHING`;
exports.GET_USER_BY_ID = 'SELECT * FROM lt_users WHERE id = $1';
/** Check if a user exists by id. Lightweight — returns only the id column. */
exports.VERIFY_USER_BY_ID = 'SELECT id FROM lt_users WHERE id = $1 LIMIT 1';
/** Fetch user + roles in a single query. Returns one row per role (or one row with nulls if no roles). */
exports.GET_USER_WITH_ROLES = `SELECT u.id, u.external_id, u.display_name, u.status, u.metadata,
          r.role, r.type AS role_type
   FROM lt_users u
   LEFT JOIN lt_user_roles r ON r.user_id = u.id
   WHERE u.external_id = $1
   ORDER BY r.created_at`;
exports.DELETE_USER_BY_ID = 'DELETE FROM lt_users WHERE id = $1';
// ─── Role management ─────────────────────────────────────────────────────────
/** Batch-load roles for many users (avoids N+1). */
exports.GET_ROLES_BY_USER_IDS = 'SELECT user_id, role, type, created_at FROM lt_user_roles WHERE user_id = ANY($1) ORDER BY created_at';
/** Upsert a user–role assignment, promoting the type if the row exists. */
exports.UPSERT_USER_ROLE = `INSERT INTO lt_user_roles (user_id, role, type) VALUES ($1, $2, $3)
   ON CONFLICT (user_id, role) DO UPDATE SET type = EXCLUDED.type
   RETURNING role, type, created_at`;
exports.DELETE_USER_ROLE = 'DELETE FROM lt_user_roles WHERE user_id = $1 AND role = $2';
exports.HAS_ROLE = 'SELECT 1 FROM lt_user_roles WHERE user_id = $1 AND role = $2 LIMIT 1';
exports.HAS_ROLE_TYPE = 'SELECT 1 FROM lt_user_roles WHERE user_id = $1 AND type = $2 LIMIT 1';
// ─── RBAC ────────────────────────────────────────────────────────────────────
/** Check if a user is an admin (or superadmin) of a specific role group. */
exports.IS_GROUP_ADMIN = `SELECT 1 FROM lt_user_roles
   WHERE user_id = $1
     AND (
       (role = $2 AND type IN ('admin', 'superadmin'))
       OR type = 'superadmin'
     )
   LIMIT 1`;
