import { registerAuthzMeta } from "./authz-meta.js";
import { createMiddleware } from "hono/factory";

//#region src/middleware/inherited-auth.ts
/**
* Documentation-only permission marker for routes whose authentication
* is already enforced by a parent `app.use()` in createApp.ts.
*
* This does NOT perform any auth check itself — it only registers
* x-authz metadata so the OpenAPI spec accurately reflects the
* auth requirement.
*
* Use this when the route lives under a path that already has
* middleware applied (e.g. `/manage/tenants/*` has `manageBearerOrSessionAuth`).
*/
const inheritedAuth = (meta) => {
	const mw = createMiddleware(async (_c, next) => {
		await next();
	});
	registerAuthzMeta(mw, meta);
	return mw;
};
/**
* Marker for routes under `/manage/tenants/*` whose auth is handled
* by `manageBearerOrSessionAuth()` in createApp.ts.
*
* No auth check runs at the route level — this is purely for OpenAPI documentation.
*/
const inheritedManageTenantAuth = () => inheritedAuth({
	resource: "organization",
	permission: "member",
	description: "Requires organization membership. Auth is enforced by the manageBearerOrSessionAuth middleware in createApp.ts."
});
/**
* Marker for routes under `/run/*` whose auth is handled
* by `runApiKeyAuth()` in createApp.ts.
*
* No auth check runs at the route level — this is purely for OpenAPI documentation.
*/
const inheritedRunApiKeyAuth = () => inheritedAuth({ description: "Requires a valid API key (Bearer token). Auth is enforced by runApiKeyAuth middleware in createApp.ts." });
/**
* Marker for routes under `/work-apps/*` whose auth is handled
* by `workAppsAuth()` in createApp.ts.
*
* No auth check runs at the route level — this is purely for OpenAPI documentation.
*/
const inheritedWorkAppsAuth = () => inheritedAuth({ description: "Requires work-apps authentication (OIDC token or Slack signature). Auth is enforced by workAppsAuth middleware in createApp.ts." });

//#endregion
export { inheritedAuth, inheritedManageTenantAuth, inheritedRunApiKeyAuth, inheritedWorkAppsAuth };