/**
 * OAuth / agent discovery metadata under `/.well-known/*`.
 *
 * These endpoints let an AI agent (claude.ai remote connectors, Cursor,
 * Copilot, etc.) auto-discover how to authenticate against Gluecron without
 * any manual configuration. They advertise ONLY endpoints that actually
 * exist today:
 *
 *   - RFC 8414  Authorization Server Metadata
 *       GET /.well-known/oauth-authorization-server
 *   - RFC 9728  Protected Resource Metadata
 *       GET /.well-known/oauth-protected-resource
 *       GET /.well-known/oauth-protected-resource/mcp   (resource-specific)
 *
 * `registration_endpoint` (RFC 7591 dynamic client registration) is now live
 * at POST /oauth/register and advertised below. `introspection_endpoint`
 * (RFC 7662) is still omitted until it ships — advertising a 404 would break
 * clients that probe it. Add it here in the same change that builds it.
 *
 * Pure/read-only, no auth, no DB. Safe to serve to anyone.
 */

import { Hono } from "hono";
import type { Context } from "hono";
import { config } from "../lib/config";
import { SUPPORTED_SCOPES } from "../lib/oauth";

const wellKnown = new Hono();

/** Absolute URL on this deployment's public origin (no trailing slash). */
function base(): string {
  // config.appBaseUrl already strips a trailing slash.
  return config.appBaseUrl;
}

/**
 * RFC 8414 — OAuth 2.0 Authorization Server Metadata.
 * The document a client reads to learn where /authorize and /token live,
 * which PKCE methods are supported, and which scopes exist.
 */
wellKnown.get("/.well-known/oauth-authorization-server", (c) => {
  const b = base();
  return c.json(
    {
      issuer: b,
      authorization_endpoint: `${b}/oauth/authorize`,
      token_endpoint: `${b}/oauth/token`,
      revocation_endpoint: `${b}/oauth/revoke`,
      // RFC 7591 dynamic client registration — lets agents self-register.
      registration_endpoint: `${b}/oauth/register`,
      scopes_supported: SUPPORTED_SCOPES,
      response_types_supported: ["code"],
      grant_types_supported: ["authorization_code", "refresh_token"],
      // PKCE (RFC 7636) — the provider verifies S256 and plain.
      code_challenge_methods_supported: ["S256", "plain"],
      token_endpoint_auth_methods_supported: [
        "client_secret_basic",
        "client_secret_post",
        "none", // public clients (PKCE, no secret)
      ],
      revocation_endpoint_auth_methods_supported: [
        "client_secret_basic",
        "client_secret_post",
        "none",
      ],
      service_documentation: `${b}/api/docs`,
    },
    200,
    { "cache-control": "public, max-age=3600" }
  );
});

/**
 * RFC 9728 — OAuth 2.0 Protected Resource Metadata.
 *
 * Served both at the root path and at `/mcp` (resource-specific). A remote
 * MCP connector reads this to learn which authorization server guards the
 * `/mcp` resource and which scopes it accepts.
 */
function protectedResourceDoc(c: Context) {
  const b = base();
  return c.json(
    {
      resource: `${b}/mcp`,
      authorization_servers: [b],
      scopes_supported: SUPPORTED_SCOPES,
      bearer_methods_supported: ["header"],
      resource_documentation: `${b}/api/docs`,
    },
    200,
    { "cache-control": "public, max-age=3600" }
  );
}

wellKnown.get("/.well-known/oauth-protected-resource", protectedResourceDoc);
// Resource-specific form (RFC 9728 §3.1) — some clients append the resource
// path when the WWW-Authenticate challenge points at `<origin>/mcp`.
wellKnown.get("/.well-known/oauth-protected-resource/mcp", protectedResourceDoc);

/**
 * Official MCP Registry domain verification (HTTP method).
 *
 * registry.modelcontextprotocol.io verifies control of the `com.gluecron`
 * namespace by fetching this file and checking the signature made with the
 * matching PRIVATE key during `mcp-publisher login http`. The value below is
 * the PUBLIC half of the publishing keypair — safe to serve to anyone.
 * Override via MCP_REGISTRY_AUTH env when the keypair is rotated.
 * Registry entry lives in ./server.json at the repo root.
 */
wellKnown.get("/.well-known/mcp-registry-auth", (c) =>
  c.text(
    process.env.MCP_REGISTRY_AUTH ||
      "v=MCPv1; k=ed25519; p=7a15jFzQv2INI1Lc9Yg8+v2Dv3QNK+r83ZfpotOOOdw=",
    200,
    { "cache-control": "public, max-age=300" }
  )
);

export default wellKnown;