import { parseScope, parseScopes } from './parseScopes';
import { getAllScopeMap } from './scopes';
const handlePatConfigApplication = (context, builder) => {
    const { pat } = context?.permissionsConfig || {};
    const hasPatRule = builder.rules.find((rule) => rule.action === 'manage' && rule.subject === 'PersonalAccessToken');
    if (!hasPatRule &&
        pat?.enabled &&
        context.organizationRole &&
        pat?.allowedOrgRoles?.includes(context.organizationRole)) {
        builder.can('manage', 'PersonalAccessToken');
    }
};
/**
 * Apply scope-based abilities to a CASL ability builder
 * @param scopeNames - Array of scope names to apply
 * @param context - Context containing organization, project, user, and space access information
 * @param builder - CASL ability builder to add permissions to
 */
const applyScopeAbilities = (context, builder) => {
    const scopeMap = getAllScopeMap({ isEnterprise: context.isEnterprise });
    context.scopes.forEach((scopeName) => {
        const scope = scopeMap[scopeName];
        if (!scope)
            return;
        const [action, subject] = parseScope(scopeName);
        const conditionsList = scope.getConditions(context);
        // Apply each condition set if there are any
        if (conditionsList.length === 0) {
            builder.can(action, subject);
        }
        else {
            conditionsList.forEach((conditions) => {
                builder.can(action, subject, conditions);
            });
        }
    });
    handlePatConfigApplication(context, builder);
};
/**
 * Apply CASL abilities from scopes to a builder. Returns the list of scope
 * names that were rejected because they are not in the runtime vocabulary so
 * the caller can log or report them with whatever logger it has on hand
 * (`parseScopes` itself is side-effect free — `common` can't depend on the
 * backend Winston logger).
 */
export const buildAbilityFromScopes = (context, builder) => {
    const isEnterprise = context.isEnterprise ?? false;
    const { valid, invalid } = parseScopes({
        scopes: context.scopes,
        isEnterprise,
    });
    const parsedContext = {
        ...context,
        scopes: valid,
        isEnterprise,
    };
    applyScopeAbilities(parsedContext, builder);
    return invalid;
};
//# sourceMappingURL=scopeAbilityBuilder.js.map