import { missingScopes } from './http/route-helpers.js';
export function resolveAuthenticatedPrincipal(req, resolver) {
    const token = resolver.extractAuthToken(req);
    return token ? resolver.describeAuthenticatedPrincipal(token) : null;
}
export function buildMissingScopeBody(target, requiredScopes, grantedScopes) {
    const missing = missingScopes(grantedScopes, requiredScopes);
    if (missing.length === 0)
        return null;
    return {
        error: `Missing required scope${missing.length === 1 ? '' : 's'} for ${target}: ${missing.join(', ')}`,
        requiredScopes: [...requiredScopes],
        grantedScopes: [...(grantedScopes ?? [])],
        missingScopes: missing,
    };
}
export function resolvePrivateHostFetchOptions(requested, context) {
    if (requested !== true)
        return {};
    if (!Boolean(context.configManager.get('network.remoteFetch.allowPrivateHosts'))) {
        return Response.json({ error: 'Private-host remote fetches are disabled by config.' }, { status: 403 });
    }
    if ('requireElevatedAccess' in context) {
        const denied = context.requireElevatedAccess(context.req);
        if (denied)
            return denied;
    }
    return { allowPrivateHosts: true, fetchMode: 'allow-private-hosts' };
}
