"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var session_exports = {};
__export(session_exports, {
  get_session: () => get_session,
  handle_request: () => handle_request
});
module.exports = __toCommonJS(session_exports);
var import_cookies = require("./cookies");
var import_jwt = require("./jwt");
async function handle_request(args) {
  const plugin_config = args.config.router ?? {};
  const { pathname } = new URL(args.request.url);
  if (plugin_config.auth && "redirect" in plugin_config.auth && pathname.startsWith(plugin_config.auth.redirect)) {
    return await redirect_auth(args);
  }
}
async function redirect_auth(args) {
  if (args.request.method === "GET") {
    const { searchParams } = new URL(
      args.request.url,
      `http://${args.request.headers.get("host")}`
    );
    const { redirectTo, ...session } = Object.fromEntries(searchParams.entries());
    const response = new Response("ok", {
      status: 302,
      headers: {
        Location: redirectTo ?? "/"
      }
    });
    await set_session(args, response, session);
    return response;
  }
  if (args.request.method === "POST") {
    const newValues = await args.request.json();
    const existing = await get_session(args.request.headers, args.session_keys);
    const response = new Response("ok", {
      status: 200
    });
    await set_session(args, response, { ...existing, ...newValues });
    return response;
  }
}
const session_cookie_name = "__houdini__";
async function set_session(req, response, value) {
  const today = new Date();
  const expires = new Date(today.getTime() + 7 * 24 * 60 * 60 * 1e3);
  const serialized = await (0, import_jwt.encode)(value, req.session_keys[0]);
  response.headers.set(
    "Set-Cookie",
    `${session_cookie_name}=${serialized}; Path=/; HttpOnly; Secure; SameSite=Lax; Expires=${expires.toUTCString()} `
  );
}
async function get_session(req, secrets) {
  const cookies = req.get("cookie");
  if (!cookies) {
    return {};
  }
  const cookie = (0, import_cookies.parse)(cookies)[session_cookie_name];
  if (!cookie) {
    return {};
  }
  for (const secret of secrets) {
    if (!await (0, import_jwt.verify)(cookie, secret)) {
      continue;
    }
    const parsed = (0, import_jwt.decode)(cookie);
    if (!parsed) {
      return {};
    }
    return parsed.payload;
  }
  return {};
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  get_session,
  handle_request
});
