//#region src/utils/signozHelpers.ts
/**
* Helper function to enforce projectId filter on SigNoz queries.
* This modifies the query payload to ensure all builder queries include
* a server-side project.id filter, preventing client-side filter bypass.
*/
function enforceSecurityFilters(payload, tenantId, projectId) {
	const modifiedPayload = JSON.parse(JSON.stringify(payload));
	if (modifiedPayload.compositeQuery?.builderQueries) for (const queryKey in modifiedPayload.compositeQuery.builderQueries) {
		const query = modifiedPayload.compositeQuery.builderQueries[queryKey];
		if (!query.filters) query.filters = {
			op: "AND",
			items: []
		};
		query.filters.items = query.filters.items.filter((item) => item.key?.key !== "tenant.id" && item.key?.key !== "project.id");
		query.filters.items.push({
			key: {
				key: "tenant.id",
				dataType: "string",
				type: "tag",
				isColumn: false,
				isJSON: false,
				id: "false"
			},
			op: "=",
			value: tenantId
		});
		if (projectId) query.filters.items.push({
			key: {
				key: "project.id",
				dataType: "string",
				type: "tag",
				isColumn: false,
				isJSON: false,
				id: "false"
			},
			op: "=",
			value: projectId
		});
	}
	return modifiedPayload;
}

//#endregion
export { enforceSecurityFilters };