import { getApiErrorMessage } from '../../clients/error-utils.js';
/**
 * Lists all access roles on a B2C Commerce instance.
 *
 * @param instance - B2C instance to query
 * @param options - Pagination options
 * @returns Roles collection with pagination info
 *
 * @example
 * ```typescript
 * const roles = await listBmRoles(instance);
 * for (const role of roles.data ?? []) {
 *   console.log(role.id, role.description);
 * }
 * ```
 */
export async function listBmRoles(instance, options = {}) {
    const { start, count } = options;
    const { data, error, response } = await instance.ocapi.GET('/roles', {
        params: { query: { start, count, select: '(**)' } },
    });
    if (error) {
        throw new Error(`Failed to list roles: ${getApiErrorMessage(error, response)}`, { cause: error });
    }
    return data;
}
/**
 * Gets details of a specific access role.
 *
 * @param instance - B2C instance to query
 * @param roleId - Role ID (e.g. "Administrator")
 * @param options - Expand options
 * @returns Role details
 *
 * @example
 * ```typescript
 * const role = await getBmRole(instance, 'Administrator', { expand: ['users'] });
 * console.log(role.id, role.user_count);
 * ```
 */
export async function getBmRole(instance, roleId, options = {}) {
    const { expand } = options;
    const { data, error, response } = await instance.ocapi.GET('/roles/{id}', {
        params: { path: { id: roleId }, query: { expand } },
    });
    if (error) {
        throw new Error(`Failed to get role ${roleId}: ${getApiErrorMessage(error, response)}`, { cause: error });
    }
    return data;
}
/**
 * Creates a new access role on an instance.
 *
 * @param instance - B2C instance
 * @param roleId - Role ID to create
 * @param role - Role properties (description, etc.)
 * @returns Created role
 *
 * @example
 * ```typescript
 * const role = await createBmRole(instance, 'MyCustomRole', { description: 'A custom role' });
 * ```
 */
export async function createBmRole(instance, roleId, role = {}) {
    const { data, error, response } = await instance.ocapi.PUT('/roles/{id}', {
        params: { path: { id: roleId } },
        body: { id: roleId, ...role },
    });
    if (error) {
        throw new Error(`Failed to create role ${roleId}: ${getApiErrorMessage(error, response)}`, { cause: error });
    }
    return data;
}
/**
 * Deletes an access role from an instance.
 *
 * System roles (e.g. "Administrator", "Support") cannot be deleted.
 *
 * @param instance - B2C instance
 * @param roleId - Role ID to delete
 *
 * @example
 * ```typescript
 * await deleteBmRole(instance, 'MyCustomRole');
 * ```
 */
export async function deleteBmRole(instance, roleId) {
    const { error, response } = await instance.ocapi.DELETE('/roles/{id}', {
        params: { path: { id: roleId } },
    });
    if (error) {
        throw new Error(`Failed to delete role ${roleId}: ${getApiErrorMessage(error, response)}`, { cause: error });
    }
}
/**
 * Assigns a user to an access role on an instance.
 *
 * @param instance - B2C instance
 * @param roleId - Role ID to grant
 * @param login - User login (email)
 * @returns The user object after assignment
 *
 * @example
 * ```typescript
 * const user = await grantBmRole(instance, 'Administrator', 'user@example.com');
 * ```
 */
export async function grantBmRole(instance, roleId, login) {
    const { data, error, response } = await instance.ocapi.PUT('/roles/{id}/users/{login}', {
        params: { path: { id: roleId, login } },
    });
    if (error) {
        throw new Error(`Failed to grant role ${roleId} to ${login}: ${getApiErrorMessage(error, response)}`, {
            cause: error,
        });
    }
    return data;
}
/**
 * Unassigns a user from an access role on an instance.
 *
 * @param instance - B2C instance
 * @param roleId - Role ID to revoke
 * @param login - User login (email)
 *
 * @example
 * ```typescript
 * await revokeBmRole(instance, 'Administrator', 'user@example.com');
 * ```
 */
export async function revokeBmRole(instance, roleId, login) {
    const { error, response } = await instance.ocapi.DELETE('/roles/{id}/users/{login}', {
        params: { path: { id: roleId, login } },
    });
    if (error) {
        throw new Error(`Failed to revoke role ${roleId} from ${login}: ${getApiErrorMessage(error, response)}`, {
            cause: error,
        });
    }
}
/**
 * Gets permissions assigned to an access role.
 *
 * @param instance - B2C instance
 * @param roleId - Role ID
 * @returns Role permissions object
 *
 * @example
 * ```typescript
 * const permissions = await getBmRolePermissions(instance, 'Administrator');
 * console.log(permissions.functional?.organization?.length);
 * ```
 */
export async function getBmRolePermissions(instance, roleId) {
    const { data, error, response } = await instance.ocapi.GET('/roles/{id}/permissions', {
        params: { path: { id: roleId } },
    });
    if (error) {
        throw new Error(`Failed to get permissions for role ${roleId}: ${getApiErrorMessage(error, response)}`, {
            cause: error,
        });
    }
    return data;
}
/**
 * Sets (replaces) all permissions for an access role.
 *
 * This is a full replacement — all existing permissions are replaced with the provided set.
 *
 * @param instance - B2C instance
 * @param roleId - Role ID
 * @param permissions - Complete permissions object
 * @returns Updated permissions
 *
 * @example
 * ```typescript
 * const perms = await getBmRolePermissions(instance, 'MyRole');
 * // ... modify perms ...
 * await setBmRolePermissions(instance, 'MyRole', perms);
 * ```
 */
export async function setBmRolePermissions(instance, roleId, permissions) {
    const { data, error, response } = await instance.ocapi.PUT('/roles/{id}/permissions', {
        params: { path: { id: roleId } },
        body: permissions,
    });
    if (error) {
        throw new Error(`Failed to set permissions for role ${roleId}: ${getApiErrorMessage(error, response)}`, {
            cause: error,
        });
    }
    return data;
}
//# sourceMappingURL=roles.js.map