import{logger as e}from"../logger/index.mjs";import{HttpStatusCodes as t}from"./httpStatusCodes.mjs";let n=function(e){return e.none=`none`,e.authenticated=`authenticated`,e.admin=`admin`,e.noneAuthenticated=`not-authenticated`,e.hasOrganization=`has-organization`,e.hasProject=`has-project`,e.hasBearer=`has-bearer`,e.oauth2=`oauth2`,e}({});const r=(e,t)=>{let r=Array.isArray(t)?t:[t],{user:i,organization:a,project:o,authType:s}=e.locals;if(r.includes(n.none))return{success:!0,message:null,data:{user:i,organization:a,project:o,authType:s}};let c=!0,l=[];r.includes(n.authenticated)&&(i||(c=!1,l.push(`User is not authenticated`))),r.includes(n.noneAuthenticated)&&i&&(c=!1,l.push(`User is authenticated`)),r.includes(n.hasOrganization)&&(a||(c=!1,l.push(`Organization is not set`))),r.includes(n.hasProject)&&(o||(c=!1,l.push(`Project is not set`))),r.includes(n.oauth2)&&s!==`oauth2`&&(c=!1,l.push(`OAuth2 authentication is required`));let u=Object.values(n),d=r.filter(e=>!u.includes(e));return d.length>0&&(c=!1,l.push(`Unknown access rules: ${d.join(`, `)}`)),{success:c,message:l.join(`, `),data:{user:i,organization:a,project:o,authType:s}}},i=(...n)=>(i,a,o)=>{let s=!1;for(let e of n)if(Array.isArray(e)?s=e.map(e=>r(a,e).success).every(e=>e):r(a,e).success&&(s=!0),s)break;if(!s){e.error(`Access denied`);let n=t.FORBIDDEN_403;a.sendStatus(n);return}o()};export{n as AccessRule,r as accessControl,i as accessControlMiddleWare};
//# sourceMappingURL=accessControl.mjs.map