"use strict";var _a;Object.defineProperty(exports,"__esModule",{value:!0}),exports.dockerCredentialsInstallCommands=exports.DockerCredentialUsage=exports.DockerCredential=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),ec2=require("../../aws-ec2"),iam=require("../../aws-iam"),core_1=require("../../core");class DockerCredential{constructor(usages){this.usages=usages}static dockerHub(secret,opts={}){return jsiiDeprecationWarnings.aws_cdk_lib_aws_secretsmanager_ISecret(secret),jsiiDeprecationWarnings.aws_cdk_lib_pipelines_ExternalDockerCredentialOptions(opts),new ExternalDockerCredential("https://index.docker.io/v1/",secret,opts)}static customRegistry(registryDomain,secret,opts={}){return jsiiDeprecationWarnings.aws_cdk_lib_aws_secretsmanager_ISecret(secret),jsiiDeprecationWarnings.aws_cdk_lib_pipelines_ExternalDockerCredentialOptions(opts),new ExternalDockerCredential(registryDomain,secret,opts)}static ecr(repositories,opts){return jsiiDeprecationWarnings.aws_cdk_lib_pipelines_EcrDockerCredentialOptions(opts),new EcrDockerCredential(repositories,opts!=null?opts:{})}_applicableForUsage(usage){return!this.usages||this.usages.includes(usage)}}exports.DockerCredential=DockerCredential,_a=JSII_RTTI_SYMBOL_1,DockerCredential[_a]={fqn:"aws-cdk-lib.pipelines.DockerCredential",version:"2.13.0"};var DockerCredentialUsage;(function(DockerCredentialUsage2){DockerCredentialUsage2.SYNTH="SYNTH",DockerCredentialUsage2.SELF_UPDATE="SELF_UPDATE",DockerCredentialUsage2.ASSET_PUBLISHING="ASSET_PUBLISHING"})(DockerCredentialUsage=exports.DockerCredentialUsage||(exports.DockerCredentialUsage={}));class ExternalDockerCredential extends DockerCredential{constructor(registryDomain,secret,opts){super(opts.usages);this.registryDomain=registryDomain,this.secret=secret,this.opts=opts}grantRead(grantee,usage){var _b;if(!this._applicableForUsage(usage))return;this.opts.assumeRole&&grantee.grantPrincipal.addToPrincipalPolicy(new iam.PolicyStatement({actions:["sts:AssumeRole"],resources:[this.opts.assumeRole.roleArn]}));const role=(_b=this.opts.assumeRole)!==null&&_b!==void 0?_b:grantee;this.secret.grantRead(role)}_renderCdkAssetsConfig(){var _b;return{[this.registryDomain]:{secretsManagerSecretId:this.secret.secretArn,secretsUsernameField:this.opts.secretUsernameField,secretsPasswordField:this.opts.secretPasswordField,assumeRoleArn:(_b=this.opts.assumeRole)===null||_b===void 0?void 0:_b.roleArn}}}}class EcrDockerCredential extends DockerCredential{constructor(repositories,opts){super(opts.usages);if(this.repositories=repositories,this.opts=opts,repositories.length===0)throw new Error("must supply at least one `ecr.IRepository` to create an `EcrDockerCredential`");this.registryDomain=core_1.Fn.select(0,core_1.Fn.split("/",repositories[0].repositoryUri))}grantRead(grantee,usage){var _b;if(!this._applicableForUsage(usage))return;this.opts.assumeRole&&grantee.grantPrincipal.addToPrincipalPolicy(new iam.PolicyStatement({actions:["sts:AssumeRole"],resources:[this.opts.assumeRole.roleArn]}));const role=(_b=this.opts.assumeRole)!==null&&_b!==void 0?_b:grantee;this.repositories.forEach(repo=>repo.grantPull(role))}_renderCdkAssetsConfig(){var _b;return{[this.registryDomain]:{ecrRepository:!0,assumeRoleArn:(_b=this.opts.assumeRole)===null||_b===void 0?void 0:_b.roleArn}}}}function dockerCredentialsInstallCommands(usage,registries,osType){const relevantRegistries=(registries!=null?registries:[]).filter(reg=>reg._applicableForUsage(usage));if(!relevantRegistries||relevantRegistries.length===0)return[];const domainCredentials=relevantRegistries.reduce(function(map,registry){return Object.assign(map,registry._renderCdkAssetsConfig()),map},{}),cdkAssetsConfigFile={version:"1.0",domainCredentials},windowsCommands=["mkdir %USERPROFILE%\\.cdk",`echo '${JSON.stringify(cdkAssetsConfigFile)}' > %USERPROFILE%\\.cdk\\cdk-docker-creds.json`],linuxCommands=["mkdir $HOME/.cdk",`echo '${JSON.stringify(cdkAssetsConfigFile)}' > $HOME/.cdk/cdk-docker-creds.json`];return osType==="both"?[...windowsCommands.map(c=>`!WINDOWS!${c}`),...linuxCommands.map(c=>`!LINUX!${c}`)]:osType===ec2.OperatingSystemType.WINDOWS?windowsCommands:linuxCommands}exports.dockerCredentialsInstallCommands=dockerCredentialsInstallCommands;
//# sourceMappingURL=docker-credentials.js.map
