import runDbClient_default from "../../../data/db/runDbClient.js";
import { requireProjectPermission } from "../../../middleware/projectAccess.js";
import { OpenAPIHono, z } from "@hono/zod-openapi";
import { AddPublicKeyRequestSchema, PublicKeyListResponseSchema, PublicKeyResponseSchema, TenantProjectParamsSchema, commonGetErrorResponses, createApiError, getAppAuthKeysForProject, updateAppAuthKeysForProject, validatePublicKey } from "@inkeep/agents-core";
import { createProtectedRoute } from "@inkeep/agents-core/middleware";

//#region src/domains/manage/routes/appAuthKeys.ts
const AppAuthKeyParamsSchema = TenantProjectParamsSchema.extend({ appId: z.string().min(1) });
const AppAuthKeyWithKidParamsSchema = AppAuthKeyParamsSchema.extend({ kid: z.string().min(1) });
const app = new OpenAPIHono();
app.openapi(createProtectedRoute({
	method: "get",
	path: "/",
	summary: "List Public Keys",
	description: "List all public keys configured for app authentication",
	operationId: "list-app-auth-keys",
	tags: ["Apps"],
	permission: requireProjectPermission("view"),
	request: { params: AppAuthKeyParamsSchema },
	responses: {
		200: {
			description: "List of public keys",
			content: { "application/json": { schema: PublicKeyListResponseSchema } }
		},
		...commonGetErrorResponses
	}
}), async (c) => {
	const { tenantId, projectId, appId } = c.req.valid("param");
	const appRecord = await getAppAuthKeysForProject(runDbClient_default)({
		scopes: {
			tenantId,
			projectId
		},
		id: appId
	});
	if (!appRecord) throw createApiError({
		code: "not_found",
		message: "App not found"
	});
	if (appRecord.config.type !== "web_client") throw createApiError({
		code: "bad_request",
		message: "Auth keys are only supported for web_client apps"
	});
	const publicKeys = appRecord.config.webClient.publicKeys ?? [];
	return c.json({ data: publicKeys });
});
app.openapi(createProtectedRoute({
	method: "post",
	path: "/",
	summary: "Add Public Key",
	description: "Add a public key for app authentication",
	operationId: "create-app-auth-key",
	tags: ["Apps"],
	permission: requireProjectPermission("edit"),
	request: {
		params: AppAuthKeyParamsSchema,
		body: { content: { "application/json": { schema: AddPublicKeyRequestSchema } } }
	},
	responses: {
		201: {
			description: "Public key added",
			content: { "application/json": { schema: PublicKeyResponseSchema } }
		},
		...commonGetErrorResponses
	}
}), async (c) => {
	const { tenantId, projectId, appId } = c.req.valid("param");
	const { kid, publicKey, algorithm } = c.req.valid("json");
	const appRecord = await getAppAuthKeysForProject(runDbClient_default)({
		scopes: {
			tenantId,
			projectId
		},
		id: appId
	});
	if (!appRecord) throw createApiError({
		code: "not_found",
		message: "App not found"
	});
	if (appRecord.config.type !== "web_client") throw createApiError({
		code: "bad_request",
		message: "Auth keys are only supported for web_client apps"
	});
	const existingKeys = appRecord.config.webClient.publicKeys ?? [];
	if (existingKeys.some((k) => k.kid === kid)) throw createApiError({
		code: "conflict",
		message: `A key with kid "${kid}" already exists on this app`
	});
	const validationResult = await validatePublicKey(publicKey, algorithm);
	if (!validationResult.valid) throw createApiError({
		code: "bad_request",
		message: validationResult.error
	});
	const newKey = {
		kid,
		publicKey,
		algorithm,
		addedAt: (/* @__PURE__ */ new Date()).toISOString()
	};
	const updatedKeys = [...existingKeys, newKey];
	await updateAppAuthKeysForProject(runDbClient_default)({
		scopes: {
			tenantId,
			projectId
		},
		id: appId,
		config: {
			type: "web_client",
			webClient: {
				...appRecord.config.webClient,
				publicKeys: updatedKeys
			}
		}
	});
	return c.json({ data: newKey }, 201);
});
app.openapi(createProtectedRoute({
	method: "delete",
	path: "/{kid}",
	summary: "Delete Public Key",
	description: "Remove a public key by kid",
	operationId: "delete-app-auth-key",
	tags: ["Apps"],
	permission: requireProjectPermission("edit"),
	request: { params: AppAuthKeyWithKidParamsSchema },
	responses: {
		204: { description: "Public key deleted" },
		...commonGetErrorResponses
	}
}), async (c) => {
	const { tenantId, projectId, appId, kid } = c.req.valid("param");
	const appRecord = await getAppAuthKeysForProject(runDbClient_default)({
		scopes: {
			tenantId,
			projectId
		},
		id: appId
	});
	if (!appRecord) throw createApiError({
		code: "not_found",
		message: "App not found"
	});
	if (appRecord.config.type !== "web_client") throw createApiError({
		code: "bad_request",
		message: "Auth keys are only supported for web_client apps"
	});
	const existingKeys = appRecord.config.webClient.publicKeys ?? [];
	if (existingKeys.findIndex((k) => k.kid === kid) === -1) throw createApiError({
		code: "not_found",
		message: `Key with kid "${kid}" not found`
	});
	const updatedKeys = existingKeys.filter((k) => k.kid !== kid);
	await updateAppAuthKeysForProject(runDbClient_default)({
		scopes: {
			tenantId,
			projectId
		},
		id: appId,
		config: {
			type: "web_client",
			webClient: {
				...appRecord.config.webClient,
				publicKeys: updatedKeys
			}
		}
	});
	return c.body(null, 204);
});
var appAuthKeys_default = app;

//#endregion
export { appAuthKeys_default as default };