"use strict";
/* Socket Lib - Built with esbuild */
"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var firewall_exports = {};
__export(firewall_exports, {
  checkFirewallPurls: () => checkFirewallPurls,
  npmPurl: () => npmPurl
});
module.exports = __toCommonJS(firewall_exports);
var import_convenience = require("../http-request/convenience");
var import_user_agent = require("../http-request/user-agent");
var import_error = require("../primordials/error");
var import_map_set = require("../primordials/map-set");
var import_promise = require("../primordials/promise");
var import_string = require("../primordials/string");
const FIREWALL_API_URL = "https://firewall-api.socket.dev/purl";
const FIREWALL_TIMEOUT = 1e4;
const FIREWALL_BLOCK_SEVERITIES = new import_map_set.SetCtor([
  "critical",
  "high"
]);
async function checkFirewallPurls(arb, requestedPackage) {
  const idealTree = arb.idealTree;
  if (!idealTree) {
    return;
  }
  const purls = [];
  for (const node of idealTree.inventory.values()) {
    if (node.isProjectRoot) {
      continue;
    }
    const { name, version } = node.package;
    if (!name || !version) {
      continue;
    }
    purls.push({ purl: npmPurl(name, version), name, version });
  }
  if (purls.length === 0) {
    return;
  }
  const blocked = [];
  await (0, import_promise.PromiseAllSettled)(
    purls.map(async ({ name, purl, version }) => {
      try {
        const data = await (0, import_convenience.httpJson)(
          `${FIREWALL_API_URL}/${encodeURIComponent(purl)}`,
          {
            headers: { "User-Agent": (0, import_user_agent.getSocketCallerUserAgent)() },
            timeout: FIREWALL_TIMEOUT,
            retries: 1,
            retryDelay: 500
          }
        );
        const blocking = (data.alerts ?? []).filter(
          (a) => a.severity && FIREWALL_BLOCK_SEVERITIES.has(a.severity)
        );
        if (blocking.length > 0) {
          blocked.push({
            name,
            version,
            alerts: blocking.map(
              (a) => `${a.severity}: ${a.type ?? a.key ?? "unknown"}`
            )
          });
        }
      } catch {
      }
    })
  );
  if (blocked.length > 0) {
    const details = blocked.map((b) => `  ${b.name}@${b.version}: ${b.alerts.join(", ")}`).join("\n");
    throw new import_error.ErrorCtor(
      `Socket Firewall blocked installation of "${requestedPackage}".
The following dependencies have security alerts:
${details}

Visit https://socket.dev for more information.`
    );
  }
}
function npmPurl(name, version) {
  const encoded = (0, import_string.StringPrototypeStartsWith)(name, "@") ? `%40${(0, import_string.StringPrototypeSlice)(name, 1)}` : name;
  const encodedVersion = (0, import_string.StringPrototypeReplace)(version, /\+/g, "%2B");
  return `pkg:npm/${encoded}@${encodedVersion}`;
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  checkFirewallPurls,
  npmPurl
});
