import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import { tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
const DOMAIN_MAPPING_ENTITY = "customer_accounts.domain_mapping";
const MAX_DOMAINS_PER_ORG = 2;
function readHostnameField(payload) {
  if (!payload || typeof payload !== "object") return null;
  const raw = payload.hostname;
  return typeof raw === "string" ? raw : null;
}
function readOrgIdField(payload) {
  if (!payload || typeof payload !== "object") return null;
  const raw = payload.organizationId ?? payload.organization_id;
  return typeof raw === "string" ? raw : null;
}
const hostnameFormatGuard = {
  id: "customer_accounts.domain_mapping.hostname-format",
  targetEntity: DOMAIN_MAPPING_ENTITY,
  operations: ["create"],
  priority: 10,
  async validate(input) {
    const raw = readHostnameField(input.mutationPayload);
    if (!raw) {
      return { ok: false, status: 422, message: "Hostname is required" };
    }
    const normalized = tryNormalizeHostname(raw);
    if (!normalized) {
      return {
        ok: false,
        status: 422,
        message: "Hostname is not a valid DNS name (must be at least two labels, ASCII or IDN)"
      };
    }
    return {
      ok: true,
      modifiedPayload: { hostname: normalized }
    };
  }
};
const hostnameUniqueGuard = {
  id: "customer_accounts.domain_mapping.hostname-unique",
  targetEntity: DOMAIN_MAPPING_ENTITY,
  operations: ["create"],
  priority: 20,
  async validate(input) {
    const raw = readHostnameField(input.mutationPayload);
    if (!raw) return { ok: true };
    const hostname = tryNormalizeHostname(raw);
    if (!hostname) return { ok: true };
    const container = await createRequestContainer();
    let service = null;
    try {
      service = container.resolve("domainMappingService");
    } catch {
      return { ok: true };
    }
    const existing = await service.resolveByHostname(hostname);
    if (!existing) return { ok: true };
    const sameOrg = existing.organizationId === readOrgIdField(input.mutationPayload);
    if (existing.tenantId !== input.tenantId || !sameOrg) {
      return {
        ok: false,
        status: 409,
        message: "This domain is not available. Please choose a different hostname."
      };
    }
    return { ok: true };
  }
};
const orgLimitGuard = {
  id: "customer_accounts.domain_mapping.org-limit",
  targetEntity: DOMAIN_MAPPING_ENTITY,
  operations: ["create"],
  priority: 30,
  async validate(input) {
    const orgId = readOrgIdField(input.mutationPayload) ?? input.organizationId;
    if (!orgId) {
      return { ok: false, status: 422, message: "Organization is required" };
    }
    const container = await createRequestContainer();
    let service = null;
    try {
      service = container.resolve("domainMappingService");
    } catch {
      return { ok: true };
    }
    const existing = await service.findByOrganization(orgId, { tenantId: input.tenantId });
    if (existing.length >= MAX_DOMAINS_PER_ORG) {
      return {
        ok: false,
        status: 409,
        message: `Each organization can have at most ${MAX_DOMAINS_PER_ORG} custom domains (one active and one pending replacement). Remove an existing domain or finish the swap first.`
      };
    }
    return { ok: true };
  }
};
const recordScopeGuard = {
  id: "customer_accounts.domain_mapping.record-scope",
  targetEntity: DOMAIN_MAPPING_ENTITY,
  operations: ["update", "delete"],
  priority: 10,
  async validate(input) {
    const resourceId = input.resourceId;
    if (!resourceId) {
      return { ok: false, status: 422, message: "Domain mapping id is required" };
    }
    const container = await createRequestContainer();
    let service = null;
    try {
      service = container.resolve("domainMappingService");
    } catch {
      return { ok: true };
    }
    const record = await service.findById(resourceId, { tenantId: input.tenantId });
    if (!record) {
      return { ok: false, status: 404, message: "Domain mapping not found" };
    }
    return { ok: true };
  }
};
const guards = [
  hostnameFormatGuard,
  hostnameUniqueGuard,
  orgLimitGuard,
  recordScopeGuard
];
export {
  guards
};
//# sourceMappingURL=guards.js.map
