"use client";
import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
import { useCallback, useState } from "react";
import { create } from "@bufbuild/protobuf";
import { IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
import { ApiResourceRefSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
import { cn } from "@stigmer/theme";
import { getUserMessage, iamRoleToString } from "@stigmer/sdk";
import { useCreateIamPolicy } from "./useCreateIamPolicy.js";
import { RoleSelector } from "./RoleSelector.js";
import { PrincipalPicker } from "./PrincipalPicker.js";
/**
 * Form for granting an organization member access to a resource.
 *
 * Lets the user pick a **person** from the org's member list (by name or
 * email, disambiguating identity sources) via {@link PrincipalPicker}, choose
 * a **role** from the resource's grantable roles, and creates the IAM policy
 * binding. The resolved `identity_account` ID is carried internally — the user
 * never types or sees raw account IDs.
 *
 * All visual properties flow through `--stgm-*` design tokens.
 *
 * @example
 * ```tsx
 * <GrantAccessForm
 *   resourceKind={ApiResourceKind.organization}
 *   resourceKindString="organization"
 *   resourceId="org-abc123"
 *   orgId="org-abc123"
 *   onGranted={(policy) => refetchAccessList()}
 *   onCancel={() => setShowForm(false)}
 * />
 * ```
 */
export function GrantAccessForm({ resourceKind, resourceKindString, resourceId, orgId, excludePrincipalIds, onGranted, onCancel, className, }) {
    const { create: createPolicy, isCreating, error, clearError } = useCreateIamPolicy();
    const [principal, setPrincipal] = useState(null);
    const [selectedRole, setSelectedRole] = useState(null);
    const canSubmit = principal !== null && selectedRole !== null && !isCreating;
    const handleSubmit = useCallback(async (e) => {
        e.preventDefault();
        if (!canSubmit || selectedRole === null || principal === null)
            return;
        clearError();
        try {
            const spec = create(IamPolicySpecSchema, {
                principal: create(ApiResourceRefSchema, {
                    kind: "identity_account",
                    id: principal.id,
                }),
                resource: create(ApiResourceRefSchema, {
                    kind: resourceKindString,
                    id: resourceId,
                }),
                relation: iamRoleToString(selectedRole),
            });
            const policy = await createPolicy(spec);
            onGranted?.(policy);
        }
        catch {
            // error state is managed by useCreateIamPolicy
        }
    }, [
        canSubmit,
        selectedRole,
        principal,
        resourceKindString,
        resourceId,
        createPolicy,
        clearError,
        onGranted,
    ]);
    return (_jsxs("form", { onSubmit: handleSubmit, className: cn("space-y-3", className), children: [_jsxs("div", { className: "space-y-3", children: [_jsx(PrincipalPicker, { orgId: orgId, value: principal, onChange: setPrincipal, excludePrincipalIds: excludePrincipalIds, disabled: isCreating }), _jsx(RoleSelector, { kind: resourceKind, selected: selectedRole, onSelect: setSelectedRole, disabled: isCreating })] }), error && (_jsx("p", { className: "text-destructive text-[0.65rem]", role: "alert", children: getUserMessage(error) })), _jsxs("div", { className: "flex items-center gap-2", children: [_jsxs("button", { type: "submit", disabled: !canSubmit, className: cn("inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium", "bg-primary text-primary-foreground hover:bg-primary-hover", "disabled:pointer-events-none disabled:opacity-40"), children: [isCreating && _jsx(SpinnerIcon, {}), "Grant access"] }), onCancel && (_jsx("button", { type: "button", onClick: onCancel, disabled: isCreating, className: cn("rounded-md px-3 py-1.5 text-xs", "text-muted-foreground hover:text-foreground hover:bg-accent-hover", "disabled:pointer-events-none disabled:opacity-50"), children: "Cancel" }))] })] }));
}
function SpinnerIcon() {
    return (_jsx("svg", { width: "12", height: "12", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", className: "animate-spin", "aria-hidden": "true", children: _jsx("path", { d: "M8 2a6 6 0 1 0 6 6" }) }));
}
//# sourceMappingURL=GrantAccessForm.js.map