// storage/rbac-store.ts — Persistence for RBAC role assignments (SPEC-166)
// Stores: data/projects/{hash}/roles.json
import { readJson, writeJson, projectDataDir } from './base-store.js';
import { withFileLock } from './file-mutex.js';
// ---------------------------------------------------------------------------
// File path
// ---------------------------------------------------------------------------
function rolesFile(projectId) {
    return `${projectDataDir(projectId)}/roles.json`;
}
// ---------------------------------------------------------------------------
// Default config
// ---------------------------------------------------------------------------
function defaultConfig(projectId) {
    return {
        enabled: false,
        projectId,
        assignments: [],
        updatedAt: new Date().toISOString(),
    };
}
// ---------------------------------------------------------------------------
// Read / Write
// ---------------------------------------------------------------------------
export async function getRbacConfig(projectId) {
    return readJson(rolesFile(projectId), defaultConfig(projectId));
}
export async function saveRbacConfig(config) {
    const updated = { ...config, updatedAt: new Date().toISOString() };
    await writeJson(rolesFile(updated.projectId), updated);
}
// ---------------------------------------------------------------------------
// Enable / Disable RBAC
// ---------------------------------------------------------------------------
export async function setRbacEnabled(projectId, enabled) {
    return withFileLock(rolesFile(projectId), async () => {
        const config = await getRbacConfig(projectId);
        config.enabled = enabled;
        await saveRbacConfig(config);
        return config;
    });
}
// ---------------------------------------------------------------------------
// Role assignment CRUD
// ---------------------------------------------------------------------------
export async function assignRole(projectId, userId, role, specId, assignedBy) {
    return withFileLock(rolesFile(projectId), async () => {
        const config = await getRbacConfig(projectId);
        // Remove existing assignment with same scope
        config.assignments = config.assignments.filter((a) => !(a.userId === userId && a.specId === specId));
        const assignment = {
            userId,
            role,
            specId,
            assignedAt: new Date().toISOString(),
            assignedBy,
        };
        config.assignments.push(assignment);
        await saveRbacConfig(config);
        return config;
    });
}
export async function removeRole(projectId, userId, specId) {
    return withFileLock(rolesFile(projectId), async () => {
        const config = await getRbacConfig(projectId);
        config.assignments = config.assignments.filter((a) => !(a.userId === userId && a.specId === specId));
        await saveRbacConfig(config);
        return config;
    });
}
export async function listAssignments(projectId) {
    const config = await getRbacConfig(projectId);
    return config.assignments;
}
//# sourceMappingURL=rbac-store.js.map