import {
  AUTH_CONNECTION_GRANT_SINK,
  AUTH_OPTIONS,
  AUTH_USER_CONTEXT,
  OAUTH_STATE_STORE,
  STRATEGY_REGISTRY
} from "./chunk-6XY6ZMMD.js";
import {
  __decorateClass,
  __decorateParam
} from "./chunk-2E224ZSN.js";

// runtime/subsystems/auth/controllers/auth.controller.ts
import {
  Controller,
  Get,
  Inject,
  Param,
  Query,
  Req,
  Res,
  HttpException,
  HttpStatus
} from "@nestjs/common";
var AuthController = class {
  constructor(registry, userContext, stateStore, grantSink, options) {
    this.registry = registry;
    this.userContext = userContext;
    this.stateStore = stateStore;
    this.grantSink = grantSink;
    this.options = options;
  }
  registry;
  userContext;
  stateStore;
  grantSink;
  options;
  async connect(slug, redirect, req, res) {
    const strategy = this.requireStrategy(slug);
    const userId = await this.userContext.getCurrentUserId(req);
    const state = await this.stateStore.generate({ userId, redirect });
    const url = strategy.buildAuthorizeUrl({
      state,
      redirectUri: this.redirectUriFor(slug)
    });
    return res.redirect(HttpStatus.FOUND, url);
  }
  async callback(slug, code, state, res) {
    const strategy = this.requireStrategy(slug);
    if (!code) {
      throw new HttpException(
        `Missing 'code' query param`,
        HttpStatus.BAD_REQUEST
      );
    }
    if (!state) {
      throw new HttpException(
        `Missing 'state' query param`,
        HttpStatus.BAD_REQUEST
      );
    }
    const { userId, redirect } = await this.stateStore.consume(state);
    const tokens = await strategy.exchangeCodeForTokens({
      code,
      redirectUri: this.redirectUriFor(slug)
    });
    await this.grantSink.createOrUpdateFromOAuthGrant({
      userId,
      provider: slug,
      accessToken: tokens.accessToken,
      refreshToken: tokens.refreshToken,
      expiresAt: tokens.expiresAt,
      scope: tokens.scope,
      externalAccountId: tokens.externalAccountId,
      providerMetadata: tokens.providerMetadata
    });
    return res.redirect(
      HttpStatus.FOUND,
      redirect ?? `/settings/connections?connected=${encodeURIComponent(slug)}`
    );
  }
  requireStrategy(slug) {
    const strategy = this.registry.get(slug);
    if (!strategy) {
      throw new HttpException(
        `Unknown provider '${slug}'`,
        HttpStatus.NOT_FOUND
      );
    }
    return strategy;
  }
  redirectUriFor(slug) {
    const base = this.options.redirectUriBase;
    if (!base) {
      throw new Error(
        `AuthModule.forRoot: redirectUriBase is required when AuthController is enabled`
      );
    }
    const trimmed = base.replace(/\/+$/, "");
    return `${trimmed}/auth/${encodeURIComponent(slug)}/callback`;
  }
};
__decorateClass([
  Get(":provider/connect"),
  __decorateParam(0, Param("provider")),
  __decorateParam(1, Query("redirect")),
  __decorateParam(2, Req()),
  __decorateParam(3, Res())
], AuthController.prototype, "connect", 1);
__decorateClass([
  Get(":provider/callback"),
  __decorateParam(0, Param("provider")),
  __decorateParam(1, Query("code")),
  __decorateParam(2, Query("state")),
  __decorateParam(3, Res())
], AuthController.prototype, "callback", 1);
AuthController = __decorateClass([
  Controller("auth"),
  __decorateParam(0, Inject(STRATEGY_REGISTRY)),
  __decorateParam(1, Inject(AUTH_USER_CONTEXT)),
  __decorateParam(2, Inject(OAUTH_STATE_STORE)),
  __decorateParam(3, Inject(AUTH_CONNECTION_GRANT_SINK)),
  __decorateParam(4, Inject(AUTH_OPTIONS))
], AuthController);

export {
  AuthController
};
//# sourceMappingURL=chunk-SZVPIHWE.js.map