import { authorizeFeatures } from "../../security/featurePolicy.js";
import { resolveCrudMutationGuardService } from "./mutation-guard-service.js";
function matchesEntity(pattern, entity) {
  if (pattern === "*") return true;
  if (pattern === entity) return true;
  if (pattern.endsWith(".*")) {
    const prefix = pattern.slice(0, -2);
    return entity.startsWith(prefix + ".");
  }
  return false;
}
async function runMutationGuards(guards, input, context) {
  const matching = guards.filter((g) => matchesEntity(g.targetEntity, input.resourceKind)).filter((g) => g.operations.includes(input.operation)).filter((g) => authorizeFeatures(g.features ?? [], { grantedFeatures: context.userFeatures })).sort((a, b) => (a.priority ?? 50) - (b.priority ?? 50));
  let payload = input.mutationPayload;
  const afterSuccessCallbacks = [];
  for (const guard of matching) {
    const result = await guard.validate({ ...input, mutationPayload: payload });
    if (!result.ok) {
      const body = result.body ?? { error: result.message ?? "Operation blocked by guard", guardId: guard.id };
      return { ok: false, errorBody: body, errorStatus: result.status ?? 422, afterSuccessCallbacks: [] };
    }
    if (result.modifiedPayload) payload = { ...payload, ...result.modifiedPayload };
    if (result.shouldRunAfterSuccess && guard.afterSuccess) {
      afterSuccessCallbacks.push({ guard, metadata: result.metadata ?? null });
    }
  }
  return { ok: true, modifiedPayload: payload !== input.mutationPayload ? payload ?? void 0 : void 0, afterSuccessCallbacks };
}
function bridgeLegacyGuard(container) {
  const legacyService = resolveCrudMutationGuardService(container);
  if (!legacyService) return null;
  return {
    id: "_legacy.crud-mutation-guard-service",
    targetEntity: "*",
    operations: ["update", "delete"],
    priority: 0,
    async validate(input) {
      const result = await legacyService.validateMutation({
        tenantId: input.tenantId,
        organizationId: input.organizationId,
        userId: input.userId,
        resourceKind: input.resourceKind,
        resourceId: input.resourceId ?? "",
        operation: input.operation,
        requestMethod: input.requestMethod,
        requestHeaders: input.requestHeaders,
        mutationPayload: input.mutationPayload
      });
      if (!result) return { ok: true };
      if (!result.ok) return { ok: false, status: result.status, body: result.body };
      return { ok: true, shouldRunAfterSuccess: result.shouldRunAfterSuccess, metadata: result.metadata ?? void 0 };
    },
    async afterSuccess(input) {
      await legacyService.afterMutationSuccess({
        tenantId: input.tenantId,
        organizationId: input.organizationId,
        userId: input.userId,
        resourceKind: input.resourceKind,
        resourceId: input.resourceId,
        operation: input.operation,
        requestMethod: input.requestMethod,
        requestHeaders: input.requestHeaders,
        metadata: input.metadata
      });
    }
  };
}
export {
  bridgeLegacyGuard,
  matchesEntity,
  runMutationGuards
};
//# sourceMappingURL=mutation-guard-registry.js.map
