"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.generateAuthenticationTypes = generateAuthenticationTypes;
function generateAuthenticationTypes(context) {
    return /* ts */ `
import { z } from 'zod'
import { Result } from '@postxl/utils'
import { Viewer } from '@authentication/auth.guard'

/**
 * ${context.authentication.types.userInfo.name} object decoder as configured in the OIDC provider.
 */
// https://www.keycloak.org/docs/latest/securing_apps/index.html#userinfo-endpoint
export const z${context.authentication.types.userInfo.name} = z.object({
  // https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
  /**
   * The Id of the user.
   */
  sub: z.string(),

  // Custom Attributes
  name: z.string(),
  preferred_username: z.string(),
  given_name: z.string(),
  family_name: z.string(),
  email: z.string(),
  uuid: z.string().optional(),
  groups: z
    .string()
    .optional()
    .transform((groups) => groups?.split(',')),

  // If part of a token, \`exp\` represents the timestamp of its expiry in seconds
  exp: z
    .number()
    .optional()
    .transform((exp) => (exp ? new Date(exp * 1000) : undefined)),
})

/**
 * ${context.authentication.types.userInfo.name} object type.
 */
export type ${context.authentication.types.userInfo.name} = z.infer<typeof z${context.authentication.types.userInfo.name}>

export const z${context.authentication.types.userRoles.name} = z.array(z.enum(['admin', 'user', 'unauthorized']))

export type ${context.authentication.types.userRoles.name} = z.infer<typeof z${context.authentication.types.userRoles.name}>

export type ViewerResult = Result<
  Omit<Viewer, 'userInfo'>,
  | {
      type: 'redirect'
      redirectUrl: string
    }
  | { type: 'waitingForServer' }
>

/**
 * The name of the cookie that holds the authentication token.
 */
export const authenticationCookieName = 'pxl-auth'  
`;
}
//# sourceMappingURL=authentication-types.generator.js.map