// configure-oauth-handler.ts — Handler for the configure_oauth MCP tool (SPEC-161).
// Reads and displays the current OAuth config status (without exposing secrets).
import { loadOAuthConfig, extractBearerToken, validateToken, } from '../transports/oauth-validator.js';
function buildStatusLines(config) {
    const exampleCurl = config.enabled
        ? 'curl -H "Authorization: Bearer <your-token>" http://localhost:3000/mcp'
        : 'curl http://localhost:3000/mcp  # No auth required — set SDD_OAUTH_API_KEY to enable';
    const envVars = {
        SDD_OAUTH_API_KEY: 'Set this to enable simple API-key auth (overrides JWT mode)',
        SDD_OAUTH_JWT_SECRET: 'Set this to enable HMAC-signed JWT validation (HS256)',
        SDD_OAUTH_ISSUER: 'Optional: expected "iss" claim in JWT (e.g. https://myapp.com)',
        SDD_OAUTH_AUDIENCE: 'Optional: expected "aud" claim in JWT (e.g. planu-mcp)',
    };
    const lines = [
        `OAuth status: ${config.enabled ? 'ENABLED' : 'DISABLED'}`,
        `Mode: ${config.mode}`,
    ];
    if (config.issuer) {
        lines.push(`Issuer: ${config.issuer}`);
    }
    if (config.audience) {
        lines.push(`Audience: ${config.audience}`);
    }
    lines.push('', 'Environment variables:');
    for (const [key, desc] of Object.entries(envVars)) {
        const isSet = process.env[key] !== undefined;
        lines.push(`  ${key}: ${isSet ? '(set)' : '(not set)'} — ${desc}`);
    }
    lines.push('', `Example: ${exampleCurl}`);
    return lines;
}
export async function handleConfigureOAuth(args) {
    const config = loadOAuthConfig();
    if (args.action === 'status') {
        const lines = buildStatusLines(config);
        return { content: [{ type: 'text', text: lines.join('\n') }] };
    }
    // action === 'test'
    const token = extractBearerToken(args.token ? `Bearer ${args.token}` : undefined);
    if (!token) {
        return {
            content: [{ type: 'text', text: 'Token test result: INVALID — No token provided for test' }],
        };
    }
    const testResult = await validateToken(token, config);
    if (testResult.valid) {
        return {
            content: [{ type: 'text', text: 'Token test result: VALID — token accepted successfully' }],
        };
    }
    return {
        content: [
            { type: 'text', text: `Token test result: INVALID — ${testResult.reason ?? 'Rejected'}` },
        ],
    };
}
//# sourceMappingURL=configure-oauth-handler.js.map