'use strict';

var chunk64ITUOXI_cjs = require('./chunk-64ITUOXI.cjs');
var chunkSXKQ7CSX_cjs = require('./chunk-SXKQ7CSX.cjs');
var memory = require('@mastra/core/memory');
var authEE = require('@mastra/core/auth/ee');

function _interopNamespace(e) {
  if (e && e.__esModule) return e;
  var n = Object.create(null);
  if (e) {
    Object.keys(e).forEach(function (k) {
      if (k !== 'default') {
        var d = Object.getOwnPropertyDescriptor(e, k);
        Object.defineProperty(n, k, d.get ? d : {
          enumerable: true,
          get: function () { return e[k]; }
        });
      }
    });
  }
  n.default = e;
  return Object.freeze(n);
}

var authEE__namespace = /*#__PURE__*/_interopNamespace(authEE);

var FALLBACK_PERMISSIONS = {
  AGENTS_CREATE: "agents:create",
  AGENTS_DELETE: "agents:delete",
  AGENTS_EXECUTE: "agents:execute",
  AGENTS_READ: "agents:read",
  MEMORY_DELETE: "memory:delete",
  MEMORY_READ: "memory:read",
  MEMORY_WRITE: "memory:write",
  TOOLS_EXECUTE: "tools:execute",
  TOOLS_READ: "tools:read",
  WORKFLOWS_EXECUTE: "workflows:execute",
  WORKFLOWS_READ: "workflows:read"
};
var realPermissions = authEE__namespace.MastraFGAPermissions;
var MastraFGAPermissions2 = realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;

// src/server/handlers/utils.ts
function validateBody(body) {
  const errorResponse = Object.entries(body).reduce((acc, [key, value]) => {
    if (!value) {
      acc[key] = `Argument "${key}" is required`;
    }
    return acc;
  }, {});
  if (Object.keys(errorResponse).length > 0) {
    throw new chunk64ITUOXI_cjs.HTTPException(400, { message: Object.values(errorResponse)[0] });
  }
}
function sanitizeBody(body, disallowedKeys) {
  for (const key of disallowedKeys) {
    if (key in body) {
      delete body[key];
    }
  }
}
function parsePerPage(value, defaultValue = 100, max = 1e3) {
  const normalized = (value || "").trim().toLowerCase();
  if (normalized === "false") {
    return false;
  }
  const parsed = parseInt(value || String(defaultValue), 10);
  if (isNaN(parsed)) return defaultValue;
  return Math.min(max, Math.max(1, parsed));
}
function parseFilters(filters) {
  if (!filters) return void 0;
  return Object.fromEntries(
    (Array.isArray(filters) ? filters : [filters]).map((attr) => {
      const [key, ...valueParts] = attr.split(":");
      const value = valueParts.join(":");
      return [key, value];
    })
  );
}
function getEffectiveResourceId(requestContext, clientResourceId) {
  const contextResourceId = requestContext?.get(chunkSXKQ7CSX_cjs.MASTRA_RESOURCE_ID_KEY);
  return contextResourceId || clientResourceId;
}
function getEffectiveThreadId(requestContext, clientThreadId) {
  const contextThreadId = requestContext?.get(chunkSXKQ7CSX_cjs.MASTRA_THREAD_ID_KEY);
  return contextThreadId || clientThreadId;
}
async function validateThreadOwnership(thread, effectiveResourceId) {
  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {
    throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Access denied: thread belongs to a different resource" });
  }
}
async function enforceThreadAccess({
  mastra,
  requestContext,
  threadId,
  thread,
  effectiveResourceId,
  permission = MastraFGAPermissions2.MEMORY_READ
}) {
  await validateThreadOwnership(thread, effectiveResourceId);
  const fgaProvider = mastra?.getServer?.()?.fga;
  if (!fgaProvider) {
    return;
  }
  const user = requestContext?.get("user");
  if (!user || typeof user !== "object") {
    throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "FGA authorization denied: authenticated user is required" });
  }
  await memory.MastraMemory.checkThreadFGA({
    mastra,
    user,
    threadId,
    resourceId: thread?.resourceId ?? effectiveResourceId,
    requestContext,
    permission
  });
}
async function validateRunOwnership(run, effectiveResourceId) {
  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {
    throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Access denied: workflow run belongs to a different resource" });
  }
}

exports.MastraFGAPermissions = MastraFGAPermissions2;
exports.enforceThreadAccess = enforceThreadAccess;
exports.getEffectiveResourceId = getEffectiveResourceId;
exports.getEffectiveThreadId = getEffectiveThreadId;
exports.parseFilters = parseFilters;
exports.parsePerPage = parsePerPage;
exports.sanitizeBody = sanitizeBody;
exports.validateBody = validateBody;
exports.validateRunOwnership = validateRunOwnership;
exports.validateThreadOwnership = validateThreadOwnership;
//# sourceMappingURL=chunk-RVD3DGBZ.cjs.map
//# sourceMappingURL=chunk-RVD3DGBZ.cjs.map