/**
 * Azure DevOps Sync Wrapper
 *
 * Wraps Azure DevOps sync operations with the SyncInterceptor for permission checks
 * and audit logging. This provides a consistent interface for all ADO sync
 * operations while ensuring they go through the permission enforcement layer.
 *
 * Usage:
 * ```typescript
 * const wrapper = new AdoSyncWrapper({
 *   client: new AdoClient(),
 *   interceptor,
 *   logger
 * });
 *
 * // All operations now go through permission enforcement
 * const workItem = await wrapper.createWorkItem(params);
 * ```
 *
 * @module sync/ado-sync-wrapper
 */
import { consoleLogger } from '../utils/logger.js';
/**
 * AdoSyncWrapper - Permission-enforced Azure DevOps sync operations
 *
 * All Azure DevOps sync operations pass through the SyncInterceptor which:
 * 1. Checks permissions before execution
 * 2. Logs all attempts (success, denied, error)
 * 3. Provides consistent error handling
 */
export class AdoSyncWrapper {
    constructor(options) {
        this.client = options.client;
        this.interceptor = options.interceptor;
        this.logger = options.logger ?? consoleLogger;
    }
    /**
     * Create an Azure DevOps work item
     *
     * @param item - Work item creation parameters
     * @param origin - Item origin (internal or external)
     * @returns Wrapped operation result
     */
    async createWorkItem(item, origin = 'internal') {
        const itemId = `${item.workItemType}:${item.title.substring(0, 50)}`;
        const operation = origin === 'external' ? 'upsert-external' : 'upsert-internal';
        const result = await this.interceptor.intercept('ado', operation, itemId, origin, () => this.client.createWorkItem(item));
        return this.toWrappedResult(result);
    }
    /**
     * Update an Azure DevOps work item
     *
     * @param update - Work item update parameters
     * @param origin - Item origin (internal or external)
     * @returns Wrapped operation result
     */
    async updateWorkItem(update, origin = 'internal') {
        const itemId = `WI-${update.id}`;
        const operation = origin === 'external' ? 'upsert-external' : 'upsert-internal';
        const result = await this.interceptor.intercept('ado', operation, itemId, origin, () => this.client.updateWorkItem(update));
        return this.toWrappedResult(result);
    }
    /**
     * Update work item state (status)
     *
     * @param workItemId - Work item ID
     * @param newState - Target state (e.g., 'Active', 'Resolved', 'Closed')
     * @returns Wrapped operation result
     */
    async updateState(workItemId, newState) {
        const itemId = `WI-${workItemId}`;
        const result = await this.interceptor.interceptStatusUpdate('ado', itemId, () => this.client.updateWorkItem({
            id: workItemId,
            state: newState,
        }));
        return this.toWrappedResult(result);
    }
    /**
     * List work items with filter (read-only, always allowed)
     *
     * @param filter - Work item filter
     * @returns Wrapped operation result
     */
    async listWorkItems(filter = {}) {
        const result = await this.interceptor.interceptRead('ado', 'list-work-items', () => this.client.listWorkItems(filter));
        return this.toWrappedResult(result);
    }
    /**
     * Add tags to a work item
     *
     * @param workItemId - Work item ID
     * @param tags - Tags to add
     * @param origin - Item origin
     * @returns Wrapped operation result
     */
    async addTags(workItemId, tags, origin = 'internal') {
        const itemId = `WI-${workItemId}`;
        const operation = origin === 'external' ? 'upsert-external' : 'upsert-internal';
        const result = await this.interceptor.intercept('ado', operation, itemId, origin, () => this.client.updateWorkItem({
            id: workItemId,
            tags,
        }));
        return this.toWrappedResult(result);
    }
    /**
     * Check if an operation would be allowed (pre-flight check)
     *
     * @param operation - Operation type
     * @param itemId - Item ID
     * @returns true if operation would be allowed
     */
    wouldAllow(operation, itemId) {
        return this.interceptor.wouldAllow('ado', operation, itemId);
    }
    /**
     * Get the underlying client for operations that don't need interception
     */
    getClient() {
        return this.client;
    }
    /**
     * Convert interceptor result to wrapped result
     */
    toWrappedResult(result) {
        if (!result.allowed) {
            return {
                success: false,
                result: null,
                denialReason: result.permission.reason,
                durationMs: result.durationMs,
            };
        }
        if (result.error) {
            return {
                success: false,
                result: null,
                error: result.error.message,
                durationMs: result.durationMs,
            };
        }
        return {
            success: true,
            result: result.result,
            durationMs: result.durationMs,
        };
    }
}
//# sourceMappingURL=ado-sync-wrapper.js.map