import Includes from "../../Types/BaseDatabase/Includes";
import ObjectID from "../../Types/ObjectID";
import QueryHelper from "../Types/Database/QueryHelper";
import { And, Equal, FindOperator } from "typeorm";
/*
 * Combines a caller-supplied filter value with a privacy Raw clause so that
 * BOTH apply. The privacy filters used to overwrite the caller's value, which
 * silently widened per-record queries (e.g. `incidentId: <id>` on the
 * incident's Private Notes page) to every record the user was allowed to see
 * — leaking notes/feed/owner rows across incidents for non-admin users.
 *
 * Runs in onBefore* hooks, i.e. BEFORE QueryUtil.serializeQuery, so the
 * existing value can be a plain value (string/ObjectID/boolean/array), an
 * Includes operator, or an already-built TypeORM FindOperator. Values are
 * converted to TypeORM operators here because serializeQuery does not
 * transform values nested inside And().
 */
export function combineWithPrivacyClause(existingValue, privacyClause) {
    const privacyOperator = privacyClause;
    if (existingValue === undefined || existingValue === null) {
        return privacyClause;
    }
    if (existingValue instanceof FindOperator) {
        return And(existingValue, privacyOperator);
    }
    if (existingValue instanceof ObjectID) {
        return And(Equal(existingValue.toString()), privacyOperator);
    }
    if (existingValue instanceof Includes) {
        return And(QueryHelper.any(existingValue.values), privacyOperator);
    }
    if (Array.isArray(existingValue)) {
        return And(QueryHelper.any(existingValue), privacyOperator);
    }
    if (typeof existingValue === "string" ||
        typeof existingValue === "number" ||
        typeof existingValue === "boolean" ||
        existingValue instanceof Date) {
        return And(Equal(existingValue), privacyOperator);
    }
    /*
     * Unrecognized operator shape (no caller passes these on privacy-filtered
     * keys today). Fail closed: the privacy clause must always apply.
     */
    return privacyClause;
}
//# sourceMappingURL=PrivacyFilterUtil.js.map