import { AUTH_CONFIG } from "../config/index.js";
import { TeamService } from "../services/team.service.js";
const registrationGuardPlugin = () => {
  return {
    id: "registration-guard",
    hooks: {
      before: [
        {
          // Intercept social signup attempts
          matcher: (ctx) => {
            const path = ctx.path || "";
            return path.includes("/sign-up/social") || path.includes("/callback/") || path.includes("/sign-up");
          },
          handler: async (ctx) => {
            var _a, _b;
            const registrationMode = ((_b = (_a = AUTH_CONFIG) == null ? void 0 : _a.registration) == null ? void 0 : _b.mode) ?? "open";
            if (registrationMode === "invitation-only") {
              const request = ctx.request;
              const url = new URL(request.url);
              const hasInviteToken = request.headers.get("x-invite-token") || url.searchParams.get("inviteToken");
              if (!hasInviteToken) {
                const teamExists = await TeamService.hasGlobal();
                if (teamExists) {
                  throw new Error("SIGNUP_RESTRICTED: Registration requires an invitation. Use an invite link or contact an administrator.");
                }
              }
            }
            return ctx;
          }
        }
      ]
    }
  };
};
export {
  registrationGuardPlugin
};
