import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
import { ensureOrganizationScope, ensureTenantScope } from "@open-mercato/shared/lib/commands/scope";
import { extractUndoPayload } from "@open-mercato/shared/lib/commands/undo";
import { StaffTeamMember } from "../data/entities.js";
function commandActorScope(ctx) {
  const isPrivilegedActor = ctx.auth?.isSuperAdmin === true || ctx.systemActor === true;
  const tenantId = isPrivilegedActor ? null : ctx.auth?.tenantId ?? ctx.organizationScope?.tenantId ?? null;
  const organizationId = isPrivilegedActor ? null : ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
  const organizationUnrestricted = isPrivilegedActor || organizationId === null && tenantId !== null && ctx.organizationScope?.allowedIds === null;
  return {
    tenantId,
    organizationId: organizationUnrestricted ? null : organizationId,
    requireTenant: !isPrivilegedActor,
    requireOrganization: !organizationUnrestricted
  };
}
function explicitStaffCommandScope(tenantId, organizationId) {
  return {
    tenantId,
    organizationId,
    requireTenant: true,
    requireOrganization: true
  };
}
function commandInputScope(ctx, tenantId, organizationId) {
  if (ctx.auth?.isSuperAdmin === true || ctx.systemActor === true) {
    return explicitStaffCommandScope(tenantId, organizationId);
  }
  ensureTenantScope(ctx, tenantId);
  ensureOrganizationScope(ctx, organizationId);
  const actorTenantId = ctx.auth?.tenantId ?? ctx.organizationScope?.tenantId ?? null;
  if (!actorTenantId || actorTenantId !== tenantId) {
    throw new CrudHttpError(403, { error: "Forbidden" });
  }
  if (!ctx.organizationScope) {
    const currentOrganizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
    if (!currentOrganizationId || currentOrganizationId !== organizationId) {
      throw new CrudHttpError(403, { error: "Forbidden" });
    }
  }
  return explicitStaffCommandScope(tenantId, organizationId);
}
function applyScopeToWhere(where, scope) {
  const scoped = { ...where };
  if (scope.requireTenant || scope.tenantId !== null) scoped.tenantId = scope.tenantId;
  if (scope.requireOrganization || scope.organizationId !== null) scoped.organizationId = scope.organizationId;
  return scoped;
}
function scopeForDecryption(scope) {
  return { tenantId: scope.tenantId, organizationId: scope.organizationId };
}
const NULL_DECRYPTION_SCOPE = { tenantId: null, organizationId: null };
function staffSnapshotScopeFromContext(ctx) {
  const tenantId = ctx.auth?.tenantId ?? null;
  if (!tenantId) return null;
  return { tenantId };
}
function staffSnapshotScopeFromSnapshot(source) {
  if (!source?.tenantId || !source.organizationId) return null;
  return { tenantId: source.tenantId, organizationId: source.organizationId };
}
function scopedStaffSnapshotWhere(id, scope) {
  const where = { id };
  if (scope?.tenantId) where.tenantId = scope.tenantId;
  if (scope?.organizationId) where.organizationId = scope.organizationId;
  return where;
}
function staffSnapshotDecryptionScope(scope) {
  if (!scope) return NULL_DECRYPTION_SCOPE;
  return {
    tenantId: scope.tenantId ?? null,
    organizationId: scope.organizationId ?? null
  };
}
async function requireTeamMember(em, memberId, scope, message = "Team member not found") {
  const member = await em.findOne(
    StaffTeamMember,
    applyScopeToWhere({ id: memberId, deletedAt: null }, scope)
  );
  if (!member) throw new CrudHttpError(404, { error: message });
  return member;
}
export {
  applyScopeToWhere,
  commandActorScope,
  commandInputScope,
  ensureOrganizationScope,
  ensureTenantScope,
  explicitStaffCommandScope,
  extractUndoPayload,
  requireTeamMember,
  scopeForDecryption,
  scopedStaffSnapshotWhere,
  staffSnapshotDecryptionScope,
  staffSnapshotScopeFromContext,
  staffSnapshotScopeFromSnapshot
};
//# sourceMappingURL=shared.js.map
