import { env } from "../env.js";
import { getInProcessFetch } from "@inkeep/agents-core";
import { createRemoteJWKSet, customFetch } from "jose";

//#region src/utils/oauthJwks.ts
let cachedJwks = null;
/**
* Shared JWKS singleton for verifying OAuth JWTs issued by the local
* oauthProvider plugin. Lazy-initialized so module imports don't depend
* on env values at load time.
*/
function getOAuthJwks() {
	if (!cachedJwks) cachedJwks = createRemoteJWKSet(new URL("/api/auth/jwks", env.INKEEP_AGENTS_API_URL || "http://localhost:3002"), { [customFetch]: getInProcessFetch() });
	return cachedJwks;
}
/**
* Issuer value that the oauthProvider plugin sets on JWTs it issues.
* Used for defense-in-depth `iss` claim validation in `jwtVerify({ issuer })`.
*/
function getOAuthIssuer() {
	return `${env.INKEEP_AGENTS_API_URL || "http://localhost:3002"}/api/auth`;
}

//#endregion
export { getOAuthIssuer, getOAuthJwks };