// tools/configure-roles-handler.ts — Handler for configure_roles tool (SPEC-166)
import { setRbacEnabled, getRbacConfig } from '../storage/rbac-store.js';
export async function handleConfigureRoles(args) {
    const config = await setRbacEnabled(args.projectId, args.enabled);
    const assignmentCount = config.assignments.length;
    const status = args.enabled ? 'enabled' : 'disabled';
    const lines = [
        `RBAC ${status} for project ${args.projectId}.`,
        `Current assignments: ${String(assignmentCount)}`,
    ];
    if (!args.enabled) {
        lines.push('All operations are now allowed (single-user mode).');
    }
    else if (assignmentCount === 0) {
        lines.push('No role assignments yet — use assign_role to grant users access.');
    }
    return { content: [{ type: 'text', text: lines.join('\n') }] };
}
export async function handleGetRbacStatus(projectId) {
    const config = await getRbacConfig(projectId);
    const lines = [
        `RBAC status for project ${projectId}:`,
        `  Enabled: ${String(config.enabled)}`,
        `  Assignments: ${String(config.assignments.length)}`,
    ];
    if (config.assignments.length > 0) {
        lines.push('');
        lines.push('Assignments:');
        for (const a of config.assignments) {
            const scope = a.specId ? ` (spec: ${a.specId})` : ' (project-level)';
            lines.push(`  - ${a.userId} → ${a.role}${scope}`);
        }
    }
    return { content: [{ type: 'text', text: lines.join('\n') }] };
}
//# sourceMappingURL=configure-roles-handler.js.map