export function generateRlsSpecTitle(table) {
    return `Security: RLS policies for ${table.name}`;
}
export function generateSchemaSpecTitle(table) {
    return `Data Model: ${table.name} table schema`;
}
function formatPolicy(policy) {
    const lines = [
        `- **${policy.name}** (${policy.operation})`,
        `  - Roles: ${policy.roles.length > 0 ? policy.roles.join(', ') : 'all'}`,
    ];
    if (policy.using) {
        lines.push(`  - USING: \`${policy.using}\``);
    }
    if (policy.withCheck) {
        lines.push(`  - WITH CHECK: \`${policy.withCheck}\``);
    }
    return lines.join('\n');
}
export function generateRlsSpecDescription(table) {
    const lines = [
        `## RLS Policies for \`${table.name}\``,
        '',
        `**Schema:** ${table.schema}`,
        `**RLS Enabled:** ${table.hasRls ? 'Yes' : 'No'}`,
        '',
    ];
    if (table.rlsPolicies.length > 0) {
        lines.push('### Policies');
        for (const policy of table.rlsPolicies) {
            lines.push(formatPolicy(policy));
        }
    }
    else {
        lines.push('_No RLS policies defined for this table._');
    }
    return lines.join('\n');
}
export function generateRlsAcceptanceCriteria(table) {
    const criteria = [];
    if (!table.hasRls) {
        criteria.push(`Table \`${table.name}\` MUST have Row Level Security (RLS) enabled`);
    }
    else {
        criteria.push(`Table \`${table.name}\` has Row Level Security (RLS) enabled`);
    }
    for (const policy of table.rlsPolicies) {
        const opLabel = policy.operation === 'ALL' ? 'all operations' : policy.operation;
        const roleLabel = policy.roles.length > 0 ? policy.roles.join(', ') : 'all roles';
        criteria.push(`Policy "${policy.name}" restricts ${opLabel} access for ${roleLabel}`);
        if (policy.using) {
            criteria.push(`Policy "${policy.name}" enforces USING condition: \`${policy.using}\``);
        }
        if (policy.withCheck) {
            criteria.push(`Policy "${policy.name}" enforces WITH CHECK condition: \`${policy.withCheck}\``);
        }
    }
    if (table.rlsPolicies.length === 0 && table.hasRls) {
        criteria.push(`Table \`${table.name}\` has RLS enabled but no policies — verify this is intentional (blocks all access by default)`);
    }
    return criteria;
}
export function generateSchemaSpecDescription(table) {
    const lines = [
        `## Schema: \`${table.name}\``,
        '',
        `**Schema:** ${table.schema}`,
        `**Columns:** ${table.columns.length}`,
        '',
        '### Columns',
        '',
        '| Name | Type | Nullable | PK | FK | Default |',
        '|------|------|----------|----|----|---------|',
    ];
    for (const col of table.columns) {
        const nullable = col.nullable ? 'Yes' : 'No';
        const pk = col.isPrimaryKey ? 'Yes' : '';
        const fk = col.isForeignKey ? (col.references ?? 'Yes') : '';
        const def = col.defaultValue ?? '';
        lines.push(`| ${col.name} | ${col.type} | ${nullable} | ${pk} | ${fk} | ${def} |`);
    }
    return lines.join('\n');
}
export function classifyRlsRisk(table) {
    if (!table.hasRls) {
        return 'critical';
    }
    if (table.rlsPolicies.length === 0) {
        return 'high';
    }
    const selectPolicies = table.rlsPolicies.filter((p) => p.operation === 'SELECT' || p.operation === 'ALL');
    const hasAuthCheck = selectPolicies.some((p) => p.using?.includes('auth.uid()') === true);
    if (selectPolicies.length > 0 && !hasAuthCheck) {
        return 'high';
    }
    const hasAllOperations = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'].every((op) => table.rlsPolicies.some((p) => p.operation === op || p.operation === 'ALL'));
    if (!hasAllOperations) {
        return 'medium';
    }
    return 'low';
}
//# sourceMappingURL=rls-spec-generator.js.map