"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.escapeLdapFilterValue = escapeLdapFilterValue;
exports.verifyCredentials = verifyCredentials;
const ldapjs_1 = __importDefault(require("ldapjs"));
/** Escape value for use inside LDAP filter (RFC4515 subset). */
function escapeLdapFilterValue(value) {
    return value.replace(/[\\*()\0]/g, (ch) => {
        const code = ch.charCodeAt(0);
        return `\\${code.toString(16).padStart(2, "0")}`;
    });
}
function bindAsync(client, dn, password) {
    return new Promise((resolve, reject) => {
        client.bind(dn, password, (err) => {
            if (err)
                reject(err);
            else
                resolve();
        });
    });
}
function unbindSafe(client) {
    try {
        client.unbind();
    }
    catch {
        /* ignore */
    }
}
function searchUserDn(client, searchBase, filter) {
    return new Promise((resolve, reject) => {
        const opts = {
            filter,
            scope: "sub",
            attributes: ["dn"],
            sizeLimit: 1,
        };
        client.search(searchBase, opts, (err, res) => {
            if (err) {
                reject(err);
                return;
            }
            let dn = null;
            res.on("searchEntry", (entry) => {
                dn = entry.dn.toString();
            });
            res.on("error", reject);
            res.on("end", (result) => {
                if (result?.status !== 0 && result?.status !== undefined) {
                    reject(new Error(`LDAP search end status ${result.status}`));
                    return;
                }
                resolve(dn);
            });
        });
    });
}
/**
 * Verify username/password against AD/LDAP:
 * service bind → search user DN → bind as user with password.
 */
async function verifyCredentials(username, password, cfg) {
    const user = (username ?? "").trim();
    if (!user || !password) {
        return { ok: false, reason: "invalid_credentials" };
    }
    const filter = cfg.searchFilter.replace(/\{\{username\}\}/g, escapeLdapFilterValue(user));
    const clientOpts = { url: cfg.url };
    if (cfg.tlsOptions) {
        clientOpts.tlsOptions = { ...cfg.tlsOptions };
    }
    const searchClient = ldapjs_1.default.createClient(clientOpts);
    try {
        await bindAsync(searchClient, cfg.bindDN, cfg.bindPassword);
        const userDn = await searchUserDn(searchClient, cfg.searchBase, filter);
        unbindSafe(searchClient);
        if (!userDn) {
            return { ok: false, reason: "user_not_found" };
        }
        const verifyClient = ldapjs_1.default.createClient(clientOpts);
        try {
            await bindAsync(verifyClient, userDn, password);
            unbindSafe(verifyClient);
            return { ok: true };
        }
        catch {
            unbindSafe(verifyClient);
            return { ok: false, reason: "invalid_credentials" };
        }
    }
    catch {
        unbindSafe(searchClient);
        return { ok: false, reason: "connection_error" };
    }
}
//# sourceMappingURL=ldapAuth.js.map