// engine/auth/scope-mapper.ts — Map OAuth scopes to accessible tool names (SPEC-161)
/**
 * Built-in scope definitions for Planu hosted MCP.
 * Consumers can override/extend via AuthConfig.scopeMappings.
 */
export const BUILTIN_SCOPE_MAPPINGS = [
    {
        scope: 'planu:read',
        tools: [
            'list_specs',
            'summarize_spec',
            'spec_history',
            'check_readiness',
            'estimate',
            'validate',
            'analyze_spec_dependencies',
            'export_spec',
            'export_session',
            'list_sessions',
            'hook_status',
            'worker_status',
            'webhook_status',
            'token_usage',
            'usage_report',
            'usage_stats',
            'llm_provider_status',
            'license_status',
            'security_report',
            'pr_status',
            'agent_swarm_status',
        ],
    },
    {
        scope: 'planu:write',
        tools: [
            'create_spec',
            'update_status',
            'delete_spec',
            'delete_project',
            'delete_decision',
            'delete_pattern',
            'log_decision',
            'init_project',
            'init_constitution',
            'clarify_requirements',
            'challenge_spec',
            'reconcile_spec',
            'generate_changelog',
            'create_release',
            'create_pr_from_spec',
            'review_pr',
            'apply_template',
            'transform_code',
            'configure_hooks',
            'configure_workers',
            'configure_llm_providers',
            'start_hooks',
            'stop_hooks',
            'start_webhook',
            'stop_webhook',
            'start_dashboard',
            'stop_dashboard',
            'manage_trash',
            'manage_plugins',
            'set_locale',
            'generate_ide_config',
            'generate_planu_ci',
            'generate_docs_site',
            'generate_spec_dashboard',
            'generate_teammate_prompt',
            'generate_sub_agent',
            'generate_skill',
        ],
    },
    {
        scope: 'planu:admin',
        tools: ['configure_auth', 'activate_license', 'deactivate_license', 'activate_group'],
    },
];
/**
 * Resolve the set of allowed tool names given the granted scopes.
 * Merges built-in mappings with any custom mappings from the config.
 *
 * @param grantedScopes - Scopes present in the validated token.
 * @param customMappings - Additional scope→tools mappings from AuthConfig.
 * @returns Deduplicated list of tool names the caller may invoke.
 */
export function resolveAllowedTools(grantedScopes, customMappings = {}) {
    const allMappings = buildMergedMappings(customMappings);
    const toolSet = new Set();
    for (const scope of grantedScopes) {
        const tools = allMappings[scope] ?? [];
        for (const tool of tools) {
            toolSet.add(tool);
        }
    }
    return [...toolSet];
}
/**
 * Check whether a specific tool is allowed given the resolved tool set.
 * When allowedTools is empty (no auth configured), all tools are accessible.
 */
export function isToolAllowed(toolName, allowedTools) {
    if (allowedTools.length === 0) {
        return true;
    }
    return allowedTools.includes(toolName);
}
/**
 * Merge built-in scope mappings with custom overrides from the auth config.
 * Custom mappings add to (not replace) built-in tool lists.
 */
function buildMergedMappings(custom) {
    const merged = {};
    for (const { scope, tools } of BUILTIN_SCOPE_MAPPINGS) {
        merged[scope] = [...tools];
    }
    for (const [scope, tools] of Object.entries(custom)) {
        const existing = merged[scope] ?? [];
        merged[scope] = [...new Set([...existing, ...tools])];
    }
    return merged;
}
//# sourceMappingURL=scope-mapper.js.map