async function authenticateMcpRequest(apiKeySecret, container) {
  if (!apiKeySecret || typeof apiKeySecret !== "string") {
    return { success: false, error: "API key is required" };
  }
  const trimmedSecret = apiKeySecret.trim();
  if (!trimmedSecret) {
    return { success: false, error: "API key is required" };
  }
  if (!trimmedSecret.startsWith("omk_")) {
    return { success: false, error: "Invalid API key format" };
  }
  try {
    const em = container.resolve("em");
    const { findApiKeyBySecret } = await import("@open-mercato/core/modules/api_keys/services/apiKeyService");
    const apiKey = await findApiKeyBySecret(em, trimmedSecret);
    if (!apiKey) {
      return { success: false, error: "Invalid or expired API key" };
    }
    const userId = `api_key:${apiKey.id}`;
    const rbacService = container.resolve("rbacService");
    const acl = await rbacService.loadAcl(userId, {
      tenantId: apiKey.tenantId ?? null,
      organizationId: apiKey.organizationId ?? null
    });
    try {
      apiKey.lastUsedAt = /* @__PURE__ */ new Date();
      await em.persist(apiKey).flush();
    } catch {
    }
    return {
      success: true,
      keyId: apiKey.id,
      keyName: apiKey.name,
      tenantId: apiKey.tenantId ?? null,
      organizationId: apiKey.organizationId ?? null,
      userId,
      features: acl.features,
      isSuperAdmin: acl.isSuperAdmin
    };
  } catch (error) {
    const message = error instanceof Error ? error.message : String(error);
    console.error("[MCP Auth] Authentication failed:", message);
    return { success: false, error: "Authentication failed" };
  }
}
function hasRequiredFeatures(requiredFeatures, userFeatures, isSuperAdmin, rbacService) {
  if (isSuperAdmin) return true;
  if (!requiredFeatures?.length) return true;
  if (rbacService) {
    return rbacService.hasAllFeatures(requiredFeatures, userFeatures);
  }
  return requiredFeatures.every((required) => {
    if (userFeatures.includes(required)) return true;
    if (userFeatures.includes("*")) return true;
    return userFeatures.some((feature) => {
      if (feature.endsWith(".*")) {
        const prefix = feature.slice(0, -2);
        return required.startsWith(prefix + ".");
      }
      return false;
    });
  });
}
function extractApiKeyFromHeaders(headers) {
  const getHeader = (name) => {
    if (headers instanceof Headers) {
      return headers.get(name);
    }
    if (headers instanceof Map) {
      return headers.get(name) ?? null;
    }
    const value = headers[name] ?? headers[name.toLowerCase()];
    return typeof value === "string" ? value : null;
  };
  const xApiKey = getHeader("x-api-key")?.trim();
  if (xApiKey) {
    return xApiKey;
  }
  const authHeader = getHeader("authorization")?.trim();
  if (authHeader && authHeader.toLowerCase().startsWith("apikey ")) {
    return authHeader.slice(7).trim();
  }
  return null;
}
export {
  authenticateMcpRequest,
  extractApiKeyFromHeaders,
  hasRequiredFeatures
};
//# sourceMappingURL=auth.js.map
