"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.AuthTokenPrefix = void 0;
exports.assertEmbeddedAuth = assertEmbeddedAuth;
exports.assertSessionAuth = assertSessionAuth;
exports.assertRegisteredAccount = assertRegisteredAccount;
exports.isAccount = isAccount;
exports.isJwtUser = isJwtUser;
exports.assertIsAccountWithOrg = assertIsAccountWithOrg;
const errors_1 = require("./errors");
/**
 * Prefixes for the authorization tokens we store in the database
 */
var AuthTokenPrefix;
(function (AuthTokenPrefix) {
    AuthTokenPrefix["SCIM"] = "scim_";
    AuthTokenPrefix["SERVICE_ACCOUNT"] = "ldsvc_";
    AuthTokenPrefix["PERSONAL_ACCESS_TOKEN"] = "ldpat_";
    AuthTokenPrefix["OAUTH_APP"] = "ldapp_";
    AuthTokenPrefix["OAUTH_REFRESH"] = "ldref_";
})(AuthTokenPrefix || (exports.AuthTokenPrefix = AuthTokenPrefix = {}));
function assertEmbeddedAuth(account) {
    if (account?.authentication.type !== 'jwt') {
        throw new errors_1.ForbiddenError(`${account?.authentication.type} Account is not jwt auth`);
    }
}
function assertSessionAuth(account) {
    if (account?.authentication.type !== 'session') {
        throw new errors_1.ForbiddenError(`${account?.authentication.type} Account is not session auth`);
    }
}
function assertRegisteredAccount(account) {
    if (!account) {
        throw new errors_1.ForbiddenError('Account is required');
    }
    if (account.user.type !== 'registered') {
        throw new errors_1.ForbiddenError('Account is not a registered user');
    }
}
function isAccount(accountOrUser) {
    return 'authentication' in accountOrUser;
}
function isJwtUser(account) {
    if (!account)
        return false;
    return account.isJwtUser();
}
function assertIsAccountWithOrg(account) {
    const { organization } = account;
    const isValidOrg = typeof organization.organizationUuid === 'string' &&
        typeof organization.name === 'string' &&
        organization.createdAt instanceof Date;
    if (!isValidOrg) {
        throw new errors_1.ForbiddenError('Account is not part of an organization');
    }
    if (account.isSessionUser()) {
        const sessionAccount = account;
        if (typeof sessionAccount.user.role !== 'string')
            throw new errors_1.ForbiddenError('Session user does not have a role in an organization');
    }
}
//# sourceMappingURL=auth.js.map