"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.authCommand = void 0;
/**
 * `inkreach auth` — authentication & config commands.
 */
const commander_1 = require("commander");
const ctx_1 = require("../lib/ctx");
const config_1 = require("../lib/config");
const output_1 = require("../lib/output");
void ctx_1.requireBaseId;
function authCommand() {
    const cmd = new commander_1.Command('auth');
    cmd.description('Manage authentication and CLI config');
    cmd
        .command('status')
        .description('Verify the configured token by calling GET /api/user/me')
        .action((0, ctx_1.run)(async (ctx) => {
        const me = (await ctx.client.getMe());
        const cfg = (0, config_1.readConfigFile)();
        if (ctx.json) {
            (0, output_1.printJson)({ config: cfg, user: me });
        }
        else {
            (0, output_1.printKv)([
                ['config path', (0, config_1.configPath)()],
                ['endpoint', cfg.endpoint || config_1.DEFAULT_ENDPOINT],
                ['token set', cfg.token ? `yes (${cfg.token.slice(0, 14)}…)` : 'no'],
                ['base id', cfg.baseId || '(none)'],
                ['', ''],
                ['user id', me?.id || 'unknown'],
                ['name', me?.name || 'unknown'],
                ['email', me?.email || 'unknown'],
            ]);
        }
    }));
    cmd
        .command('login')
        .description('Configure endpoint, token, and default base id')
        .option('--endpoint <url>', 'Backend URL (default http://localhost:3000)')
        .option('--token <pat>', 'Personal Access Token (format: teable_xxx_yyy)')
        .option('--base-id <id>', 'Default base id for subsequent commands')
        .action((0, ctx_1.run)(async (ctx, _args, o) => {
        const opts = o;
        // Merge global flags (--token/--endpoint/--base-id on the program) with
        // this subcommand's own --endpoint/--token/--base-id options.
        const g = ctx.program.opts();
        const patch = {};
        const endpoint = opts.endpoint || g.endpoint;
        const tokenVal = opts.token || g.token;
        const baseId = opts.baseId || g.baseId;
        if (endpoint)
            patch.endpoint = endpoint;
        if (tokenVal)
            patch.token = tokenVal;
        if (baseId)
            patch.baseId = baseId;
        (0, config_1.writeConfigFile)(patch);
        const cfg = (0, config_1.readConfigFile)();
        if (ctx.json) {
            (0, output_1.printJson)({ ok: true, config: cfg });
        }
        else {
            process.stdout.write('✓ Configuration saved:\n');
            (0, output_1.printKv)([
                ['endpoint', cfg.endpoint || config_1.DEFAULT_ENDPOINT],
                ['token', cfg.token ? `set (${cfg.token.slice(0, 14)}…)` : '(not set)'],
                ['base id', cfg.baseId || '(none)'],
                ['path', (0, config_1.configPath)()],
            ]);
        }
    }));
    const token = cmd.command('token').description('Manage Personal Access Tokens (PAT)');
    token
        .command('list')
        .description('List your access tokens')
        .action((0, ctx_1.run)(async (ctx) => {
        const list = (await ctx.client.listAccessTokens());
        if (ctx.json)
            (0, output_1.printJson)(list);
        else
            (0, output_1.printTable)([
                { key: 'id', header: 'ID' },
                { key: 'name', header: 'NAME' },
                { key: 'scopes', header: 'SCOPES' },
                { key: 'expiredTime', header: 'EXPIRES' },
            ], list.map((t) => ({ ...t, scopes: (t.scopes || []).join(',') })));
    }));
    token
        .command('create')
        .description('Create a PAT. The full token is returned ONLY ONCE.')
        .requiredOption('--name <name>', 'Token name')
        .option('--scopes <csv>', 'Comma-separated scopes', 'automation|read,automation|create,automation|update,automation|delete,table|read,record|read,record|create,record|update')
        .option('--base-ids <csv>', 'Restrict to base ids (comma-separated). Omit for full access')
        .option('--full-access', 'Grant full access')
        .option('--expires <date>', 'Expiry date YYYY-MM-DD (default 2099-12-31)', '2099-12-31')
        .action((0, ctx_1.run)(async (ctx, _args, o) => {
        const opts = o;
        const scopes = opts.scopes.split(',').map((s) => s.trim()).filter(Boolean);
        const baseIds = opts['base-ids']
            ? opts['base-ids'].split(',').map((s) => s.trim())
            : undefined;
        const created = (await ctx.client.createAccessToken({
            name: opts.name,
            scopes,
            baseIds,
            hasFullAccess: !!opts['full-access'],
            expiredTime: opts.expires,
        }));
        if (ctx.json)
            (0, output_1.printJson)(created);
        else {
            (0, output_1.printKv)([
                ['id', created.id],
                ['token', created.token],
                ['', ''],
                ['note', 'Save this token now — it cannot be retrieved again.'],
                ['use', 'inkreach auth login --token <above>'],
            ]);
        }
    }));
    token
        .command('delete <id>')
        .description('Revoke an access token')
        .action((0, ctx_1.run)(async (ctx, args) => {
        const id = args[0];
        await ctx.client.deleteAccessToken(id);
        if (ctx.json)
            (0, output_1.printJson)({ ok: true, id });
        else
            process.stdout.write(`✓ Token ${id} revoked\n`);
    }));
    return cmd;
}
exports.authCommand = authCommand;