/**
 * Workflow Permission Presets
 *
 * Story MSSCI-11847: Permission Presets by Workflow
 *
 * This module provides permission checking for workflow presets.
 * Workflows can define required permissions that are checked at startup.
 */
/**
 * Check if a permission preset is covered by a cached grant
 *
 * Matching requires:
 * - Same tool name (case-sensitive)
 * - Same scope pattern (exact match)
 *
 * @param preset - Permission preset from workflow
 * @param grant - Cached permission grant
 * @returns True if the grant covers the preset
 */
function isGranted(preset, grant) {
    return preset.tool === grant.tool && preset.scope === grant.scope;
}
/**
 * Check workflow permissions against cached grants
 *
 * For each permission preset defined in the workflow, checks if there's
 * a matching grant in the cache. Returns lists of granted and missing
 * permissions so the caller can prompt for missing ones.
 *
 * @param workflowPermissions - Permissions required by the workflow
 * @param cachedGrants - Currently cached permission grants
 * @returns Result indicating which permissions are granted vs missing
 *
 * @example
 * ```typescript
 * const result = checkWorkflowPermissions(workflow.permissions, grants);
 * if (!result.allGranted) {
 *   // Prompt user for result.missing permissions
 *   for (const perm of result.missing) {
 *     console.log(`Need permission: ${perm.tool} - ${perm.reason}`);
 *   }
 * }
 * ```
 */
export function checkWorkflowPermissions(workflowPermissions, cachedGrants) {
    const missing = [];
    const granted = [];
    for (const preset of workflowPermissions) {
        // Check if any cached grant covers this preset
        const hasGrant = cachedGrants.some((grant) => isGranted(preset, grant));
        if (hasGrant) {
            granted.push(preset);
        }
        else {
            missing.push(preset);
        }
    }
    return {
        allGranted: missing.length === 0,
        missing,
        granted,
    };
}
//# sourceMappingURL=workflow-permissions.js.map