"use strict";
/**
 * Shared Routes — Path safety helpers
 *
 * Prevents directory traversal by resolving real paths and checking
 * containment within allowed roots before any file I/O.
 */
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
    if (mod && mod.__esModule) return mod;
    var result = {};
    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
    __setModuleDefault(result, mod);
    return result;
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.getCcsDir = exports.resolveSettingsAllowedRoots = exports.resolveAllowedRoots = exports.isPathWithinAny = exports.isPathWithin = exports.normalizeForPathComparison = exports.safeRealPath = void 0;
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
const claude_config_path_1 = require("../utils/claude-config-path");
const config_loader_facade_1 = require("../config/config-loader-facade");
Object.defineProperty(exports, "getCcsDir", { enumerable: true, get: function () { return config_loader_facade_1.getCcsDir; } });
function safeRealPath(targetPath) {
    try {
        return fs.realpathSync(targetPath);
    }
    catch {
        return null;
    }
}
exports.safeRealPath = safeRealPath;
function normalizeForPathComparison(targetPath) {
    const normalized = path.resolve(targetPath);
    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
}
exports.normalizeForPathComparison = normalizeForPathComparison;
function isPathWithin(candidatePath, basePath) {
    const normalizedCandidate = normalizeForPathComparison(candidatePath);
    const normalizedBase = normalizeForPathComparison(basePath);
    const relative = path.relative(normalizedBase, normalizedCandidate);
    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
}
exports.isPathWithin = isPathWithin;
function isPathWithinAny(candidatePath, basePaths) {
    for (const basePath of basePaths) {
        if (isPathWithin(candidatePath, basePath)) {
            return true;
        }
    }
    return false;
}
exports.isPathWithinAny = isPathWithinAny;
function resolveAllowedRoots(type, ccsDir, sharedDirRoot) {
    if (type === 'commands' || type === 'plugins') {
        return new Set([sharedDirRoot]);
    }
    return new Set([
        sharedDirRoot,
        ...[
            path.join((0, claude_config_path_1.getClaudeConfigDir)(), type),
            path.join(ccsDir, '.claude', type),
            path.join(ccsDir, 'shared', type),
        ]
            .map((dirPath) => safeRealPath(dirPath))
            .filter((dirPath) => typeof dirPath === 'string'),
    ]);
}
exports.resolveAllowedRoots = resolveAllowedRoots;
function resolveSettingsAllowedRoots(ccsDir, sharedDirRoot) {
    const claudeConfigDir = (0, claude_config_path_1.getClaudeConfigDir)();
    return new Set([
        sharedDirRoot,
        safeRealPath(path.join(claudeConfigDir, 'settings.json')),
        safeRealPath(path.join(ccsDir, '.claude', 'settings.json')),
    ].filter((dirPath) => typeof dirPath === 'string'));
}
exports.resolveSettingsAllowedRoots = resolveSettingsAllowedRoots;
//# sourceMappingURL=shared-routes-path-guards.js.map