import { debugRevealErrorResponse, formatDebugRevealStatus, } from "../security/DebugRevealService.js";
import { authorizeWorkspace, requireLocalUiSessionForBrowserRoute, } from "./authGuards.js";
import { writeJson } from "./publicResponse.js";
import { readJsonBody } from "./requestParsing.js";
import { firstCapture, matchPath, secondCapture } from "./routeMatching.js";
export async function handleSecurityContractRoute(context) {
    const { request, response, url } = context;
    if (request.method !== "GET" || url.pathname !== "/security/contracts") {
        return false;
    }
    writeJson(response, 200, {
        credentialAuthority: "patchtrail-credential-vault",
        secretStorage: [
            "os-credential-store",
            "encrypted-local-fallback",
            "dev-only-in-memory",
        ],
        runtimeBinaryTrust: "tuf-inspired-metadata-required",
        permissionApproval: {
            default: "ask_every_permission_requiring_tool_call",
            breakGlassConfirmation: "clear_modal_explicit_confirm_button",
            typedConfirmation: false,
            osAuthRequired: false,
            externalServiceMutationDefault: "unchecked",
            requiredSurfaces: [
                "active-state-banner",
                "audit-log",
                "one-click-revoke",
            ],
        },
    });
    return true;
}
export async function handleDebugRevealRoutes(context) {
    const { app, auth, request, response, url } = context;
    const workspaceDebugRevealStatusMatch = matchPath(url.pathname, /^\/workspaces\/([^/]+)\/debug-reveal\/status$/);
    if (request.method === "GET" && workspaceDebugRevealStatusMatch) {
        if (!requireLocalUiSessionForBrowserRoute(response, auth, {
            request,
            routeId: "workspace.debug-reveal.status",
        })) {
            return true;
        }
        const workspaceId = firstCapture(workspaceDebugRevealStatusMatch);
        if (!authorizeWorkspace(response, auth, workspaceId))
            return true;
        writeJson(response, 200, {
            debugReveal: formatDebugRevealStatus(app.debugReveal.status(workspaceId)),
        });
        return true;
    }
    const workspaceDebugRevealSessionsMatch = matchPath(url.pathname, /^\/workspaces\/([^/]+)\/debug-reveal\/sessions$/);
    if (request.method === "POST" && workspaceDebugRevealSessionsMatch) {
        if (!requireLocalUiSessionForBrowserRoute(response, auth, {
            request,
            routeId: "workspace.debug-reveal.sessions",
        })) {
            return true;
        }
        if (auth.kind !== "local-ui-session")
            return true;
        const workspaceId = firstCapture(workspaceDebugRevealSessionsMatch);
        if (!authorizeWorkspace(response, auth, workspaceId))
            return true;
        try {
            const body = await readJsonBody(request);
            writeJson(response, 201, {
                debugReveal: formatDebugRevealStatus(app.debugReveal.activate({
                    workspaceId,
                    body,
                    actor: auth.session,
                })),
            });
        }
        catch (error) {
            if (writeDebugRevealError(response, error))
                return true;
            throw error;
        }
        return true;
    }
    const workspaceDebugRevealRevokeMatch = matchPath(url.pathname, /^\/workspaces\/([^/]+)\/debug-reveal\/sessions\/([^/]+)$/);
    if (request.method === "DELETE" && workspaceDebugRevealRevokeMatch) {
        if (!requireLocalUiSessionForBrowserRoute(response, auth, {
            request,
            routeId: "workspace.debug-reveal.sessions.revoke",
        })) {
            return true;
        }
        if (auth.kind !== "local-ui-session")
            return true;
        const workspaceId = firstCapture(workspaceDebugRevealRevokeMatch);
        const revealSessionId = secondCapture(workspaceDebugRevealRevokeMatch);
        if (!authorizeWorkspace(response, auth, workspaceId))
            return true;
        try {
            const body = await readJsonBody(request);
            writeJson(response, 200, {
                debugReveal: formatDebugRevealStatus(app.debugReveal.revoke({
                    workspaceId,
                    revealSessionId,
                    body,
                    actor: auth.session,
                })),
            });
        }
        catch (error) {
            if (writeDebugRevealError(response, error))
                return true;
            throw error;
        }
        return true;
    }
    return false;
}
function writeDebugRevealError(response, error) {
    const result = debugRevealErrorResponse(error);
    if (!result)
        return false;
    writeJson(response, result.statusCode, result.body);
    return true;
}
