import { ForbiddenError } from './errors';
/**
 * Prefixes for the authorization tokens we store in the database
 */
export var AuthTokenPrefix;
(function (AuthTokenPrefix) {
    AuthTokenPrefix["SCIM"] = "scim_";
    AuthTokenPrefix["SERVICE_ACCOUNT"] = "ldsvc_";
    AuthTokenPrefix["PERSONAL_ACCESS_TOKEN"] = "ldpat_";
    AuthTokenPrefix["OAUTH_APP"] = "ldapp_";
    AuthTokenPrefix["OAUTH_REFRESH"] = "ldref_";
})(AuthTokenPrefix || (AuthTokenPrefix = {}));
export function assertEmbeddedAuth(account) {
    if (account?.authentication.type !== 'jwt') {
        throw new ForbiddenError(`${account?.authentication.type} Account is not jwt auth`);
    }
}
export function assertSessionAuth(account) {
    if (account?.authentication.type !== 'session') {
        throw new ForbiddenError(`${account?.authentication.type} Account is not session auth`);
    }
}
export function assertRegisteredAccount(account) {
    if (!account) {
        throw new ForbiddenError('Account is required');
    }
    if (account.user.type !== 'registered') {
        throw new ForbiddenError('Account is not a registered user');
    }
}
export function isAccount(accountOrUser) {
    return 'authentication' in accountOrUser;
}
export function isJwtUser(account) {
    if (!account)
        return false;
    return account.isJwtUser();
}
export function assertIsAccountWithOrg(account) {
    const { organization } = account;
    const isValidOrg = typeof organization.organizationUuid === 'string' &&
        typeof organization.name === 'string' &&
        organization.createdAt instanceof Date;
    if (!isValidOrg) {
        throw new ForbiddenError('Account is not part of an organization');
    }
    if (account.isSessionUser()) {
        const sessionAccount = account;
        if (typeof sessionAccount.user.role !== 'string')
            throw new ForbiddenError('Session user does not have a role in an organization');
    }
}
//# sourceMappingURL=auth.js.map