/**
 * Telegram bot auth middleware.
 * Enforces allowedChatIds globally before any command handler runs (D-10).
 * Unauthorized chats are silently ignored — no reply, no log (D-09).
 */
import { loadAllowedChatIds } from "../notifyStore.js";
const CACHE_TTL_MS = 5_000;
let cachedIds = null;
let cacheTime = 0;
/** Reset internal cache — for testing only. */
export function _resetCache() {
    cachedIds = null;
    cacheTime = 0;
}
function getCachedAllowedIds() {
    const now = Date.now();
    if (cachedIds === null || now - cacheTime > CACHE_TTL_MS) {
        cachedIds = loadAllowedChatIds();
        cacheTime = now;
    }
    return cachedIds;
}
export async function allowedChatIdsMiddleware(ctx, next) {
    const allowed = getCachedAllowedIds();
    if (allowed.length === 0) {
        // Fail-closed: deny all when no allowlist configured (security audit MEDIUM-001)
        return;
    }
    const chatId = String(ctx.chat?.id ?? "");
    if (allowed.includes(chatId)) {
        await next();
    }
}
//# sourceMappingURL=middleware.js.map