"use strict";
/**
 * Auth Token Manager for CLIProxyAPI
 *
 * Manages API key and management secret resolution with inheritance:
 * - Per-variant override → Global config → Default constants
 *
 * Provides secure token generation for user customization.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.getAuthSummary = exports.resetAuthToDefaults = exports.setVariantApiKey = exports.setGlobalManagementSecret = exports.setGlobalApiKey = exports.getEffectiveManagementSecret = exports.getEffectiveApiKey = exports.maskToken = exports.generateSecureToken = void 0;
const crypto_1 = require("crypto");
const generator_1 = require("../config/generator");
const config_loader_facade_1 = require("../../config/config-loader-facade");
/**
 * Generate a cryptographically secure token.
 * Uses CSPRNG (crypto.randomBytes) for proper entropy.
 *
 * @param length - Number of random bytes (default: 32 = 256-bit entropy)
 * @returns Base64URL-encoded token (43 chars for 32 bytes)
 */
function generateSecureToken(length = 32) {
    return (0, crypto_1.randomBytes)(length).toString('base64url');
}
exports.generateSecureToken = generateSecureToken;
/**
 * Mask a token for display.
 * Shows first 4 and last 4 chars: "ccs_...4f2a"
 * Used by CLI commands and API routes.
 */
function maskToken(token) {
    if (token.length <= 8)
        return '****';
    return `${token.slice(0, 4)}...${token.slice(-4)}`;
}
exports.maskToken = maskToken;
/**
 * Get effective API key with inheritance chain.
 * Priority: variant auth → global cliproxy.auth → default constant
 *
 * @param variantName - Optional variant name for per-variant override
 * @returns Resolved API key
 */
function getEffectiveApiKey(variantName) {
    const config = (0, config_loader_facade_1.loadOrCreateUnifiedConfig)();
    // Priority 1: Per-variant override
    if (variantName) {
        const variant = config.cliproxy.variants[variantName];
        if (variant?.auth?.api_key) {
            return variant.auth.api_key;
        }
    }
    // Priority 2: Global cliproxy.auth
    if (config.cliproxy.auth?.api_key) {
        return config.cliproxy.auth.api_key;
    }
    // Priority 3: Default constant (backwards compatible)
    return generator_1.CCS_INTERNAL_API_KEY;
}
exports.getEffectiveApiKey = getEffectiveApiKey;
/**
 * Get effective management secret.
 * Priority: global cliproxy.auth → default constant
 *
 * Note: Management secret is global-only (no per-variant override)
 * as it controls the Control Panel access for the entire CLIProxy instance.
 *
 * @returns Resolved management secret
 */
function getEffectiveManagementSecret() {
    const config = (0, config_loader_facade_1.loadOrCreateUnifiedConfig)();
    // Priority 1: Global cliproxy.auth
    if (config.cliproxy.auth?.management_secret) {
        return config.cliproxy.auth.management_secret;
    }
    // Priority 2: Default constant (backwards compatible)
    return generator_1.CCS_CONTROL_PANEL_SECRET;
}
exports.getEffectiveManagementSecret = getEffectiveManagementSecret;
/**
 * Set global API key.
 * Updates cliproxy.auth.api_key in config.yaml.
 *
 * @param apiKey - New API key (or undefined to reset to default)
 */
function setGlobalApiKey(apiKey) {
    (0, config_loader_facade_1.mutateConfig)((config) => {
        if (!config.cliproxy.auth) {
            config.cliproxy.auth = {};
        }
        if (apiKey === undefined) {
            delete config.cliproxy.auth.api_key;
        }
        else {
            config.cliproxy.auth.api_key = apiKey;
        }
    });
}
exports.setGlobalApiKey = setGlobalApiKey;
/**
 * Set global management secret.
 * Updates cliproxy.auth.management_secret in config.yaml.
 *
 * @param secret - New management secret (or undefined to reset to default)
 */
function setGlobalManagementSecret(secret) {
    (0, config_loader_facade_1.mutateConfig)((config) => {
        if (!config.cliproxy.auth) {
            config.cliproxy.auth = {};
        }
        if (secret === undefined) {
            delete config.cliproxy.auth.management_secret;
        }
        else {
            config.cliproxy.auth.management_secret = secret;
        }
    });
}
exports.setGlobalManagementSecret = setGlobalManagementSecret;
/**
 * Set per-variant API key override.
 * Updates variants[variantName].auth.api_key in config.yaml.
 *
 * @param variantName - Variant name
 * @param apiKey - New API key (or undefined to remove override)
 */
function setVariantApiKey(variantName, apiKey) {
    (0, config_loader_facade_1.mutateConfig)((config) => {
        const variant = config.cliproxy.variants[variantName];
        if (!variant) {
            throw new Error(`Variant '${variantName}' not found`);
        }
        if (!variant.auth) {
            variant.auth = {};
        }
        if (apiKey === undefined) {
            delete variant.auth.api_key;
            if (Object.keys(variant.auth).length === 0) {
                delete variant.auth;
            }
        }
        else {
            variant.auth.api_key = apiKey;
        }
    });
}
exports.setVariantApiKey = setVariantApiKey;
/**
 * Reset all auth settings to defaults.
 * Removes cliproxy.auth and all variant auth overrides.
 */
function resetAuthToDefaults() {
    (0, config_loader_facade_1.mutateConfig)((config) => {
        delete config.cliproxy.auth;
        for (const variantName of Object.keys(config.cliproxy.variants)) {
            const variant = config.cliproxy.variants[variantName];
            if (variant.auth) {
                delete variant.auth;
            }
        }
    });
}
exports.resetAuthToDefaults = resetAuthToDefaults;
/**
 * Get auth configuration summary for display.
 * Returns current effective values and whether they're customized.
 */
function getAuthSummary() {
    const config = (0, config_loader_facade_1.loadOrCreateUnifiedConfig)();
    const customApiKey = config.cliproxy.auth?.api_key;
    const customSecret = config.cliproxy.auth?.management_secret;
    return {
        apiKey: {
            value: customApiKey || generator_1.CCS_INTERNAL_API_KEY,
            isCustom: !!customApiKey,
        },
        managementSecret: {
            value: customSecret || generator_1.CCS_CONTROL_PANEL_SECRET,
            isCustom: !!customSecret,
        },
    };
}
exports.getAuthSummary = getAuthSummary;
//# sourceMappingURL=auth-token-manager.js.map