{"version":3,"file":"network-policy.cjs","names":["allow: Record<string, NetworkPolicyRule[]>"],"sources":["../../src/utils/network-policy.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { NetworkPolicy, NetworkPolicyRule } from \"../network-policy.js\";\nimport {\n  NetworkPolicyRequestValidator,\n  NetworkPolicyResponseValidator,\n} from \"../api-client/validators.js\";\n\ntype APIRequestNetworkPolicy = z.infer<typeof NetworkPolicyRequestValidator>;\ntype APIResponseNetworkPolicy = z.infer<typeof NetworkPolicyResponseValidator>;\n\nexport function toAPINetworkPolicy(\n  policy: NetworkPolicy,\n): APIRequestNetworkPolicy {\n  if (policy === \"allow-all\" || policy === \"deny-all\") {\n    return { mode: policy };\n  }\n\n  return policy;\n}\n\nexport function fromAPINetworkPolicy(\n  api: APIResponseNetworkPolicy,\n): NetworkPolicy {\n  if (api.mode === \"allow-all\" || api.mode === \"deny-all\") {\n    return api.mode;\n  }\n\n  const subnets =\n    api.allowedCIDRs || api.deniedCIDRs\n      ? {\n          subnets: {\n            ...(api.allowedCIDRs && { allow: api.allowedCIDRs }),\n            ...(api.deniedCIDRs && { deny: api.deniedCIDRs }),\n          },\n        }\n      : undefined;\n\n  // If L7 rules are present, reconstruct the record form.\n  // The API returns headerNames (secret values are stripped), so we\n  // populate each header value with \"<redacted>\".\n  if (\n    (api.injectionRules && api.injectionRules.length > 0) ||\n    (api.forwardRules && api.forwardRules.length > 0)\n  ) {\n    const rulesByDomain = new Map<string, NetworkPolicyRule[]>();\n    for (const rule of api.injectionRules ?? []) {\n      const headers = Object.fromEntries(\n        (rule.headerNames ?? []).map((n) => [n, \"<redacted>\"]),\n      );\n      const rules = rulesByDomain.get(rule.domain) ?? [];\n      rules.push({\n        ...(rule.match ? { match: rule.match } : {}),\n        transform: [{ headers }],\n      });\n      rulesByDomain.set(rule.domain, rules);\n    }\n    for (const rule of api.forwardRules ?? []) {\n      const rules = rulesByDomain.get(rule.domain) ?? [];\n      rules.push({\n        ...(rule.match ? { match: rule.match } : {}),\n        forwardURL: rule.forwardURL,\n      });\n      rulesByDomain.set(rule.domain, rules);\n    }\n\n    const allow: Record<string, NetworkPolicyRule[]> = {};\n    for (const domain of api.allowedDomains ?? []) {\n      allow[domain] = rulesByDomain.get(domain) ?? [];\n    }\n    // Include L7 rules for domains not in allowedDomains\n    for (const rule of [...(api.injectionRules ?? []), ...(api.forwardRules ?? [])]) {\n      if (!(rule.domain in allow)) {\n        allow[rule.domain] = rulesByDomain.get(rule.domain) ?? [];\n      }\n    }\n\n    return { allow, ...subnets };\n  }\n\n  return {\n    ...(api.allowedDomains && { allow: api.allowedDomains }),\n    ...subnets,\n  };\n}\n"],"mappings":";;AAoBA,SAAgB,qBACd,KACe;AACf,KAAI,IAAI,SAAS,eAAe,IAAI,SAAS,WAC3C,QAAO,IAAI;CAGb,MAAM,UACJ,IAAI,gBAAgB,IAAI,cACpB,EACE,SAAS;EACP,GAAI,IAAI,gBAAgB,EAAE,OAAO,IAAI,cAAc;EACnD,GAAI,IAAI,eAAe,EAAE,MAAM,IAAI,aAAa;EACjD,EACF,GACD;AAKN,KACG,IAAI,kBAAkB,IAAI,eAAe,SAAS,KAClD,IAAI,gBAAgB,IAAI,aAAa,SAAS,GAC/C;EACA,MAAM,gCAAgB,IAAI,KAAkC;AAC5D,OAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,EAAE;GAC3C,MAAM,UAAU,OAAO,aACpB,KAAK,eAAe,EAAE,EAAE,KAAK,MAAM,CAAC,GAAG,aAAa,CAAC,CACvD;GACD,MAAM,QAAQ,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAClD,SAAM,KAAK;IACT,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;IAC3C,WAAW,CAAC,EAAE,SAAS,CAAC;IACzB,CAAC;AACF,iBAAc,IAAI,KAAK,QAAQ,MAAM;;AAEvC,OAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,EAAE;GACzC,MAAM,QAAQ,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAClD,SAAM,KAAK;IACT,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;IAC3C,YAAY,KAAK;IAClB,CAAC;AACF,iBAAc,IAAI,KAAK,QAAQ,MAAM;;EAGvC,MAAMA,QAA6C,EAAE;AACrD,OAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAC3C,OAAM,UAAU,cAAc,IAAI,OAAO,IAAI,EAAE;AAGjD,OAAK,MAAM,QAAQ,CAAC,GAAI,IAAI,kBAAkB,EAAE,EAAG,GAAI,IAAI,gBAAgB,EAAE,CAAE,CAC7E,KAAI,EAAE,KAAK,UAAU,OACnB,OAAM,KAAK,UAAU,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAI7D,SAAO;GAAE;GAAO,GAAG;GAAS;;AAG9B,QAAO;EACL,GAAI,IAAI,kBAAkB,EAAE,OAAO,IAAI,gBAAgB;EACvD,GAAG;EACJ"}