'use strict';

// src/server/auth/defaults.ts
var defaultAuthConfig = {
  protected: ["/api/*"],
  public: ["/api", "/api/auth/*"],
  // Simple rule system
  rules: [
    // Admin users can do anything
    {
      condition: (user) => {
        if (typeof user === "object" && user !== null) {
          if ("isAdmin" in user) {
            return !!user.isAdmin;
          }
          if ("role" in user) {
            return user.role === "admin";
          }
        }
        return false;
      },
      allow: true
    }
  ]
};

// src/server/auth/path-pattern.ts
function parse(input, loose) {
  if (input instanceof RegExp) return { keys: false, pattern: input };
  let c;
  let o;
  let tmp;
  let ext;
  const keys = [];
  let pattern = "";
  const arr = input.split("/");
  arr[0] || arr.shift();
  while (tmp = arr.shift()) {
    c = tmp[0];
    if (c === "*") {
      keys.push(c);
      pattern += tmp[1] === "?" ? "(?:/(.*))?" : "/(.*)";
    } else if (c === ":") {
      o = tmp.indexOf("?", 1);
      ext = tmp.indexOf(".", 1);
      keys.push(tmp.substring(1, !!~o ? o : !!~ext ? ext : tmp.length));
      pattern += !!~o && !~ext ? "(?:/([^/]+?))?" : "/([^/]+?)";
      if (!!~ext) pattern += (!!~o ? "?" : "") + "\\" + tmp.substring(ext);
    } else {
      pattern += "/" + tmp;
    }
  }
  return {
    keys,
    pattern: new RegExp("^" + pattern + ("/?$"), "i")
  };
}

// src/server/auth/helpers.ts
var isProtectedCustomRoute = (path, method, customRouteAuthConfig) => {
  if (!customRouteAuthConfig) {
    return false;
  }
  const exactRouteKey = `${method}:${path}`;
  if (customRouteAuthConfig.has(exactRouteKey)) {
    return customRouteAuthConfig.get(exactRouteKey) === true;
  }
  const allRouteKey = `ALL:${path}`;
  if (customRouteAuthConfig.has(allRouteKey)) {
    return customRouteAuthConfig.get(allRouteKey) === true;
  }
  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {
    const colonIndex = routeKey.indexOf(":");
    if (colonIndex === -1) {
      continue;
    }
    const routeMethod = routeKey.substring(0, colonIndex);
    const routePattern = routeKey.substring(colonIndex + 1);
    if (routeMethod !== method && routeMethod !== "ALL") {
      continue;
    }
    if (pathMatchesPattern(path, routePattern)) {
      return requiresAuth === true;
    }
  }
  return false;
};
var isDevPlaygroundRequest = (path, method, getHeader, authConfig, customRouteAuthConfig) => {
  const protectedAccess = [...defaultAuthConfig.protected || [], ...authConfig.protected || []];
  return process.env.MASTRA_DEV === "true" && // Allow if path doesn't match protected patterns AND is not a protected custom route
  (!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig) || // Or if has playground header
  getHeader("x-mastra-dev-playground") === "true");
};
var isCustomRoutePublic = (path, method, customRouteAuthConfig) => {
  if (!customRouteAuthConfig) {
    return false;
  }
  const exactRouteKey = `${method}:${path}`;
  if (customRouteAuthConfig.has(exactRouteKey)) {
    return !customRouteAuthConfig.get(exactRouteKey);
  }
  const allRouteKey = `ALL:${path}`;
  if (customRouteAuthConfig.has(allRouteKey)) {
    return !customRouteAuthConfig.get(allRouteKey);
  }
  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {
    const colonIndex = routeKey.indexOf(":");
    if (colonIndex === -1) {
      continue;
    }
    const routeMethod = routeKey.substring(0, colonIndex);
    const routePattern = routeKey.substring(colonIndex + 1);
    if (routeMethod !== method && routeMethod !== "ALL") {
      continue;
    }
    if (pathMatchesPattern(path, routePattern)) {
      return !requiresAuth;
    }
  }
  return false;
};
var isProtectedPath = (path, method, authConfig, customRouteAuthConfig) => {
  const protectedAccess = [...defaultAuthConfig.protected || [], ...authConfig.protected || []];
  return isAnyMatch(path, method, protectedAccess) || !isCustomRoutePublic(path, method, customRouteAuthConfig);
};
var canAccessPublicly = (path, method, authConfig) => {
  const publicAccess = [...defaultAuthConfig.public || [], ...authConfig.public || []];
  return isAnyMatch(path, method, publicAccess);
};
var isAnyMatch = (path, method, patterns) => {
  if (!patterns) {
    return false;
  }
  for (const patternPathOrMethod of patterns) {
    if (patternPathOrMethod instanceof RegExp) {
      if (patternPathOrMethod.test(path)) {
        return true;
      }
    }
    if (typeof patternPathOrMethod === "string" && pathMatchesPattern(path, patternPathOrMethod)) {
      return true;
    }
    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {
      const [pattern, methodOrMethods] = patternPathOrMethod;
      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {
        return true;
      }
    }
  }
  return false;
};
var pathMatchesPattern = (path, pattern) => {
  const { pattern: regex } = parse(pattern);
  return regex.test(path);
};
var pathMatchesRule = (path, rulePath) => {
  if (!rulePath) return true;
  if (typeof rulePath === "string") {
    return pathMatchesPattern(path, rulePath);
  }
  if (rulePath instanceof RegExp) {
    return rulePath.test(path);
  }
  if (Array.isArray(rulePath)) {
    return rulePath.some((p) => pathMatchesPattern(path, p));
  }
  return false;
};
var matchesOrIncludes = (values, value) => {
  if (typeof values === "string") {
    return values === value;
  }
  if (Array.isArray(values)) {
    return values.includes(value);
  }
  return false;
};
var checkRules = async (rules, path, method, user) => {
  for (const i in rules || []) {
    const rule = rules?.[i];
    if (!pathMatchesRule(path, rule.path)) {
      continue;
    }
    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {
      continue;
    }
    const condition = rule.condition;
    if (typeof condition === "function") {
      const allowed = await Promise.resolve().then(() => condition(user)).catch(() => false);
      if (allowed) {
        return true;
      }
    } else if (rule.allow) {
      return true;
    }
  }
  return false;
};

exports.canAccessPublicly = canAccessPublicly;
exports.checkRules = checkRules;
exports.defaultAuthConfig = defaultAuthConfig;
exports.isCustomRoutePublic = isCustomRoutePublic;
exports.isDevPlaygroundRequest = isDevPlaygroundRequest;
exports.isProtectedCustomRoute = isProtectedCustomRoute;
exports.isProtectedPath = isProtectedPath;
exports.matchesOrIncludes = matchesOrIncludes;
exports.pathMatchesPattern = pathMatchesPattern;
exports.pathMatchesRule = pathMatchesRule;
//# sourceMappingURL=chunk-I5B5RVRT.cjs.map
//# sourceMappingURL=chunk-I5B5RVRT.cjs.map