"use strict";
var __create = Object.create;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __getProtoOf = Object.getPrototypeOf;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
  // If the importer is in node compatibility mode or this is not an ESM
  // file that has been converted to a CommonJS file using a Babel-
  // compatible transform (i.e. "__esModule" has not been set), then set
  // "default" to the CommonJS "module.exports" for node compatibility.
  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
  mod
));
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var auth_exports = {};
__export(auth_exports, {
  firstUserHandler: () => firstUserHandler,
  loginHandler: () => loginHandler,
  logoutHandler: () => logoutHandler,
  meHandler: () => meHandler,
  setupStatusHandler: () => setupStatusHandler
});
module.exports = __toCommonJS(auth_exports);
var import_crypto = require("crypto");
var import_bcryptjs = __toESM(require("bcryptjs"));
var import_rjweb_server = require("rjweb-server");
var import_db = require("../lib/db");
var import_response = require("../lib/response");
var import_errors = require("../lib/errors");
var import_logger = require("../lib/logger");
const log = (0, import_logger.createLogger)("AUTH_ROUTE");
const COOKIE_NAME = "pp_session";
const COOKIE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
async function loginHandler(ctr) {
  let body;
  try {
    body = await ctr.body();
  } catch {
    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "Invalid body" } });
  }
  const { username, password } = body || {};
  if (!username || !password) {
    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "Username and password required" } });
  }
  const user = await import_db.prisma.user.findUnique({ where: { username } });
  if (!user) {
    return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: "Invalid credentials" } });
  }
  const valid = await import_bcryptjs.default.compare(password, user.passwordHash);
  if (!valid) {
    return (0, import_response.makeResponse)({ ctr, content: { code: 401, message: "Invalid credentials" } });
  }
  const sessionHash = (0, import_crypto.randomBytes)(32).toString("hex");
  await import_db.prisma.session.create({ data: { hash: sessionHash, userId: user.id } });
  ctr.cookies.set(
    COOKIE_NAME,
    new import_rjweb_server.Cookie(sessionHash, {
      httpOnly: true,
      expires: new Date(Date.now() + COOKIE_MAX_AGE_MS),
      path: "/",
      sameSite: "Lax"
    })
  );
  return (0, import_response.makeResponse)({ ctr, content: { code: 200, data: { id: user.id, username: user.username, isAdmin: user.isAdmin } } });
}
async function logoutHandler(ctr) {
  const auth = ctr.getAuth?.();
  if (auth?.success) {
    await import_db.prisma.session.delete({ where: { id: auth.sessionId } }).catch(() => {
    });
  }
  ctr.cookies.set(COOKIE_NAME, new import_rjweb_server.Cookie("", { expires: /* @__PURE__ */ new Date(0), path: "/" }));
  return (0, import_response.makeResponse)({ ctr, content: { code: 200, message: "Logged out" } });
}
async function meHandler(ctr) {
  const auth = ctr.getAuth?.();
  if (!auth?.success) {
    return (0, import_response.makeResponse)({ ctr, content: { code: import_errors.ERROR_MESSAGES.UNAUTHORIZED.code, message: import_errors.ERROR_MESSAGES.UNAUTHORIZED.message } });
  }
  const user = await import_db.prisma.user.findUnique({ where: { id: auth.user.id } });
  if (!user) return (0, import_response.makeResponse)({ ctr, content: { code: 404, message: "User not found" } });
  return (0, import_response.makeResponse)({
    ctr,
    content: {
      code: 200,
      data: {
        id: user.id,
        username: user.username,
        isAdmin: user.isAdmin,
        isFounder: user.isFounder,
        giteaUsername: user.giteaUsername,
        giteaInstanceUrl: user.giteaInstanceUrl,
        giteaPatSet: !!user.giteaPAT,
        awsAccessKeyId: user.awsAccessKeyId ? "****" : null,
        awsRegion: user.awsRegion,
        awsConfigured: !!(user.awsAccessKeyId && user.awsSecretAccessKey && user.awsRegion),
        setupComplete: !!(user.giteaInstanceUrl && user.giteaPAT && user.awsAccessKeyId && user.awsSecretAccessKey && user.awsRegion)
      }
    }
  });
}
async function setupStatusHandler(ctr) {
  const count = await import_db.prisma.user.count();
  return (0, import_response.makeResponse)({ ctr, content: { code: 200, data: { needsSetup: count === 0 } } });
}
async function firstUserHandler(ctr) {
  const count = await import_db.prisma.user.count();
  if (count > 0) {
    return (0, import_response.makeResponse)({ ctr, content: { code: 403, message: "Setup already completed. Contact an administrator to create your account." } });
  }
  let body;
  try {
    body = await ctr.body();
  } catch {
    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "Invalid body" } });
  }
  const { username, password } = body || {};
  if (!username || !password || password.length < 8) {
    return (0, import_response.makeResponse)({ ctr, content: { code: 400, message: "Username and password (min 8 chars) required" } });
  }
  const hash = await import_bcryptjs.default.hash(password, 12);
  const user = await import_db.prisma.user.create({
    data: { username, passwordHash: hash, isAdmin: true, isFounder: true }
  });
  const sessionHash = (0, import_crypto.randomBytes)(32).toString("hex");
  await import_db.prisma.session.create({ data: { hash: sessionHash, userId: user.id } });
  ctr.cookies.set(
    COOKIE_NAME,
    new import_rjweb_server.Cookie(sessionHash, {
      httpOnly: true,
      expires: new Date(Date.now() + COOKIE_MAX_AGE_MS),
      path: "/",
      sameSite: "Lax"
    })
  );
  log.info({ username }, "First user (founder) created");
  return (0, import_response.makeResponse)({ ctr, content: { code: 201, data: { id: user.id, username: user.username, isAdmin: true, isFounder: true } } });
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  firstUserHandler,
  loginHandler,
  logoutHandler,
  meHandler,
  setupStatusHandler
});
//# sourceMappingURL=auth.js.map