import { Logger } from '../../../../../src/index.js';
/**
 * Middleware to strip unknown properties from the request body.
 * Only properties included in the allowedKeys list are preserved.
 */
export const withStrictPayloadKeys = (allowedKeys, handler) => {
    const allowedSet = new Set(allowedKeys);
    return async (req, res) => {
        try {
            const data = req.data();
            if (!data || typeof data !== 'object' || Array.isArray(data)) {
                // If body is not an object, skip stripping or strictly enforce object?
                // For worker creation, it must be an object.
                // Let's rely on downstream validators to complain if data is missing/wrong type.
                return handler(req, res);
            }
            const body = data;
            const strippedBody = {};
            let hasUnknowns = false;
            for (const key of Object.keys(body)) {
                if (allowedSet.has(key)) {
                    strippedBody[key] = body[key];
                }
                else {
                    hasUnknowns = true;
                }
            }
            if (hasUnknowns) {
                // Update the body with sanitized version
                req.setBody(strippedBody);
            }
            return handler(req, res);
        }
        catch (error) {
            Logger.error('Strict payload validation failed', error);
            return res.setStatus(500).json({
                error: 'Internal validation error',
                code: 'VALIDATION_ERROR',
            });
        }
    };
};
