import { authorizeFeatures } from "../../security/featurePolicy.js";
function canReadSearchEntity(entityId, lookup, subject, options = {}) {
  if (subject.isSuperAdmin) return true;
  const config = lookup.getEntityConfig(entityId);
  if (!config) {
    options.onDeny?.(entityId, "unconfigured");
    return false;
  }
  const required = config.aclFeatures;
  if (!required || required.length === 0) {
    options.onDeny?.(entityId, "no-acl-features");
    return false;
  }
  const allowed = authorizeFeatures(required, {
    grantedFeatures: subject.grantedFeatures,
    unrestricted: false
  });
  if (!allowed) options.onDeny?.(entityId, "insufficient-features");
  return allowed;
}
function resolveReadableEntityTypes(lookup, subject, requestedEntityTypes) {
  if (subject.isSuperAdmin) return requestedEntityTypes;
  const readable = lookup.getAllEntityConfigs().filter((config) => config.enabled !== false).map((config) => config.entityId).filter((entityId) => canReadSearchEntity(entityId, lookup, subject));
  if (!requestedEntityTypes) return readable;
  const requested = new Set(requestedEntityTypes);
  return readable.filter((entityId) => requested.has(entityId));
}
function filterSearchResultsByEntityAccess(results, lookup, subject, options = {}) {
  if (subject.isSuperAdmin) return [...results];
  const decisions = /* @__PURE__ */ new Map();
  return results.filter((result) => {
    const cached = decisions.get(result.entityId);
    if (cached !== void 0) return cached;
    const allowed = canReadSearchEntity(result.entityId, lookup, subject, options);
    decisions.set(result.entityId, allowed);
    return allowed;
  });
}
export {
  canReadSearchEntity,
  filterSearchResultsByEntityAccess,
  resolveReadableEntityTypes
};
//# sourceMappingURL=entityAccess.js.map
