import {
  type JwksDocument,
  OAuthGetJwksHandler,
} from '@app/o-auth/flows/application/get-jwks/o-auth-get-jwks.handler';
import { Controller, Get } from '@nestjs/common';

/**
 * RFC 7517 — JWKS endpoint. Serves this instance's RSA public key so that other
 * catalyst deployments running in `OAUTH_STRATEGY=aurora-hub` mode can validate the
 * access tokens this instance issues. The endpoint is mounted at the root path
 * (NOT under the `/api` global prefix); `main.ts` excludes `.well-known/jwks.json`.
 *
 * Pure transport: ALL JWKS construction logic lives in `OAuthGetJwksHandler`. This
 * controller only exposes the handler's output at the HTTP path.
 */
@Controller()
export class OAuthGetJwksController {
  constructor(private readonly handler: OAuthGetJwksHandler) {}

  @Get('.well-known/jwks.json')
  main(): JwksDocument {
    return this.handler.main();
  }
}
