/**
 * Decodes the `Authorization: Basic <base64(clientId:clientSecret)>` header per RFC 6749
 * §2.3.1. Shared by the REST controller (`OAuthCreateTokenController`) and the GraphQL
 * resolver (`OAuthCreateTokenResolver`) so both transports authenticate clients with the
 * same wire format — there is ONE way to present client credentials to Aurora.
 *
 * Returns empty strings when the header is absent, the scheme is not `Basic`, or the
 * encoding is malformed. The handler downstream receives them and raises the canonical
 * RFC 6749 §5.2 `InvalidClientError`. NO business decision happens here.
 */
export const oAuthParseBasicAuth = (
  header: string | undefined,
): { clientId: string; clientSecret: string } => {
  if (!header || !header.startsWith('Basic ')) return { clientId: '', clientSecret: '' };
  const encoded = header.substring('Basic '.length).trim();
  try {
    const decoded = Buffer.from(encoded, 'base64').toString('utf-8');
    const colon = decoded.indexOf(':');
    if (colon === -1) return { clientId: '', clientSecret: '' };
    return {
      clientId: decoded.substring(0, colon),
      clientSecret: decoded.substring(colon + 1),
    };
  } catch {
    return { clientId: '', clientSecret: '' };
  }
};
