import { getLogger as getLogger$1 } from "../logger.js";
import { env } from "../env.js";
import { exchangeMcpAuthorizationCode, initiateMcpOAuthFlow } from "@inkeep/agents-core";

//#region src/utils/oauthService.ts
const logger = getLogger$1("oauth-service");
const pkceStore = /* @__PURE__ */ new Map();
/**
* Store PKCE verifier and OAuth metadata for later use in token exchange
*/
function storePKCEVerifier(state, codeVerifier, toolId, tenantId, projectId, clientInformation, metadata, resourceUrl) {
	pkceStore.set(state, {
		codeVerifier,
		toolId,
		tenantId,
		projectId,
		clientInformation,
		metadata,
		resourceUrl
	});
	setTimeout(() => {
		pkceStore.delete(state);
	}, 600 * 1e3);
}
/**
* Retrieve and remove PKCE verifier
*/
function retrievePKCEVerifier(state) {
	const data = pkceStore.get(state);
	if (data) {
		pkceStore.delete(state);
		return data;
	}
	return null;
}
/**
* OAuth service class that handles the complete OAuth flow
*/
var OAuthService = class {
	defaultConfig;
	constructor(config = {}) {
		this.defaultConfig = {
			defaultClientId: config.defaultClientId || process.env.DEFAULT_OAUTH_CLIENT_ID || "mcp-client",
			clientName: config.clientName || process.env.OAUTH_CLIENT_NAME || "Inkeep Agent Framework",
			clientUri: config.clientUri || process.env.OAUTH_CLIENT_URI || "https://inkeep.com",
			logoUri: config.logoUri || process.env.OAUTH_CLIENT_LOGO_URI || "https://inkeep.com/images/logos/inkeep-logo-blue.svg",
			redirectBaseUrl: config.redirectBaseUrl || env.INKEEP_AGENTS_API_URL
		};
	}
	/**
	* Initiate OAuth flow for an MCP tool using MCP SDK
	*/
	async initiateOAuthFlow(params) {
		const { tenantId, projectId, toolId, mcpServerUrl, baseUrl } = params;
		const redirectUri = `${baseUrl || this.defaultConfig.redirectBaseUrl}/manage/oauth/callback`;
		const state = `tool_${toolId}`;
		const authResult = await initiateMcpOAuthFlow({
			mcpServerUrl,
			redirectUri,
			state,
			clientName: this.defaultConfig.clientName,
			clientUri: this.defaultConfig.clientUri,
			logoUri: this.defaultConfig.logoUri,
			defaultClientId: this.defaultConfig.defaultClientId,
			logger
		});
		storePKCEVerifier(state, authResult.codeVerifier, toolId, tenantId, projectId, authResult.clientInformation, authResult.metadata, authResult.resourceUrl);
		logger.info({
			toolId,
			authorizationUrl: authResult.authorizationUrl,
			tenantId,
			projectId,
			scopes: authResult.scopes
		}, "MCP OAuth flow initiated successfully");
		return {
			redirectUrl: authResult.authorizationUrl,
			state
		};
	}
	/**
	* Exchange authorization code for access tokens using MCP SDK with stored metadata
	*/
	async exchangeCodeForTokens(params) {
		const { code, codeVerifier, clientInformation, metadata, resourceUrl, mcpServerUrl, baseUrl } = params;
		const tokens = await exchangeMcpAuthorizationCode({
			mcpServerUrl,
			metadata,
			clientInformation,
			authorizationCode: code,
			codeVerifier,
			redirectUri: `${baseUrl || this.defaultConfig.redirectBaseUrl}/manage/oauth/callback`,
			resourceUrl,
			logger
		});
		logger.info({
			tokenType: tokens.token_type,
			hasRefreshToken: !!tokens.refresh_token,
			clientId: clientInformation.client_id
		}, "MCP token exchange successful");
		return { tokens };
	}
};
const oauthService = new OAuthService();

//#endregion
export { oauthService, retrievePKCEVerifier };