import type {
  ConnectionId,
  CredentialReferenceId,
  PrincipalId,
  ProjectId,
  ProviderId,
} from "./ids.js";
import type { Capability } from "./security.js";
export type ConnectionStatus =
  | "connected"
  | "needs-resource-selection"
  | "needs-permission"
  | "needs-reauth"
  | "revoked"
  | "degraded";
export interface CredentialReference {
  readonly id: CredentialReferenceId;
  readonly secretStoreKey: string;
  readonly secretVersion?: string;
}
export interface CredentialMutationAuthority {
  readonly connectionId: ConnectionId;
  readonly credentialReferenceId: CredentialReferenceId;
  readonly ownerId: PrincipalId;
  readonly generation: number;
}
export interface Connection {
  readonly id: ConnectionId;
  readonly providerId: ProviderId;
  readonly credentialReferenceId: CredentialReferenceId;
  readonly status: ConnectionStatus;
  readonly accountIdentity?: string;
  readonly capabilities: readonly Capability[];
  readonly resources: readonly string[];
}
export interface ProjectConnectionBinding {
  readonly projectId: ProjectId;
  readonly connectionId: ConnectionId;
  readonly capabilities: readonly Capability[];
  readonly resources: readonly string[];
  readonly revision: number;
}
export function assertConnectionBindingNarrows(
  connection: Connection,
  binding: ProjectConnectionBinding,
): void {
  const cap = new Set(connection.capabilities);
  const res = new Set(connection.resources);
  const badCaps = binding.capabilities.filter((v) => !cap.has(v));
  const badRes = binding.resources.filter((v) => !res.has(v));
  if (badCaps.length || badRes.length)
    throw new Error(
      `Connection binding broadens authority: capabilities=[${badCaps.join(",")}] resources=[${badRes.join(",")}]`,
    );
}