const mockAPIKeys = {
  "test_key_12345": {
    id: "api_key_1",
    clientId: "client_123",
    userId: "user_456",
    scopes: ["task:read", "task:create", "task:update", "task:delete", "user:read"],
    active: true,
    name: "Development Key",
    lastUsed: (/* @__PURE__ */ new Date()).toISOString(),
    metadata: {
      environment: "development",
      rateLimit: 1e3
    }
  },
  "prod_key_67890": {
    id: "api_key_2",
    clientId: "client_789",
    scopes: ["task:read", "task:create", "user:read"],
    active: true,
    name: "Production Key",
    lastUsed: (/* @__PURE__ */ new Date()).toISOString(),
    expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1e3).toISOString(),
    // 1 year
    metadata: {
      environment: "production",
      rateLimit: 1e4
    }
  },
  "inactive_key": {
    id: "api_key_3",
    clientId: "client_inactive",
    scopes: ["task:read"],
    active: false,
    name: "Inactive Key",
    metadata: {
      reason: "Deactivated for security reasons"
    }
  }
};
async function validateAPIKey(apiKey, options = {}) {
  const {
    requiredScopes = [],
    entityName,
    allowInactive = false
  } = options;
  if (!apiKey || typeof apiKey !== "string") {
    return {
      valid: false,
      reason: "API key is required"
    };
  }
  const keyData = mockAPIKeys[apiKey];
  if (!keyData) {
    return {
      valid: false,
      reason: "Invalid API key"
    };
  }
  if (!keyData.active && !allowInactive) {
    return {
      valid: false,
      reason: "API key is inactive",
      apiKeyId: keyData.id,
      clientId: keyData.clientId
    };
  }
  if (keyData.expiresAt && new Date(keyData.expiresAt) < /* @__PURE__ */ new Date()) {
    return {
      valid: false,
      reason: "API key has expired",
      apiKeyId: keyData.id,
      clientId: keyData.clientId
    };
  }
  const hasRequiredScopes = requiredScopes.every(
    (scope) => keyData.scopes.includes(scope) || keyData.scopes.includes("*") || entityName && keyData.scopes.includes(`${entityName}:*`)
  );
  if (!hasRequiredScopes) {
    return {
      valid: false,
      reason: "Insufficient permissions",
      apiKeyId: keyData.id,
      clientId: keyData.clientId,
      scopes: keyData.scopes
    };
  }
  keyData.lastUsed = (/* @__PURE__ */ new Date()).toISOString();
  return {
    valid: true,
    apiKeyId: keyData.id,
    clientId: keyData.clientId,
    userId: keyData.userId,
    scopes: keyData.scopes,
    metadata: keyData.metadata
  };
}
function generateScope(entityName, action) {
  return `${entityName}:${action}`;
}
function hasScope(scopes, requiredScope) {
  return scopes.includes(requiredScope) || scopes.includes("*") || scopes.includes(requiredScope.split(":")[0] + ":*");
}
async function createAPIKey(data) {
  const apiKey = `key_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  const keyData = {
    id: `api_key_${Date.now()}`,
    active: true,
    lastUsed: (/* @__PURE__ */ new Date()).toISOString(),
    ...data
  };
  mockAPIKeys[apiKey] = keyData;
  return { apiKey, keyData };
}
async function revokeAPIKey(apiKey) {
  const keyData = mockAPIKeys[apiKey];
  if (!keyData) {
    return false;
  }
  keyData.active = false;
  return true;
}
async function listAPIKeys(clientId) {
  return Object.values(mockAPIKeys).filter((key) => key.clientId === clientId);
}
async function getAPIKeyAnalytics(apiKey) {
  const keyData = mockAPIKeys[apiKey];
  if (!keyData) {
    return null;
  }
  return {
    requests: 0,
    // In production, track actual request count
    lastUsed: keyData.lastUsed,
    scopes: keyData.scopes,
    active: keyData.active
  };
}
export {
  createAPIKey,
  generateScope,
  getAPIKeyAnalytics,
  hasScope,
  listAPIKeys,
  revokeAPIKey,
  validateAPIKey
};
