const decodePayload = (token) => {
  try {
    const part = String(token || "").split(".")[1] || "";
    return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
  } catch {
    return {};
  }
};

const call = async (label, token) => {
  const headers = token === undefined ? {} : { Authorization: `Bearer ${token}` };
  const response = await fetch("http://127.0.0.1:8787/api/mcp/annotations?limit=1", { headers });
  const body = await response.text();
  console.log("[oauth-probe]", JSON.stringify({
    test: label,
    status: response.status,
    body: body.slice(0, 240)
  }));
  return response.status;
};

(async () => {
  const issuer = String(process.env.MCP_TEST_ISSUER || "").replace(/\/$/, "");
  const clientId = String(process.env.MCP_TEST_CLIENT_ID || "");
  const clientSecret = String(process.env.MCP_TEST_CLIENT_SECRET || "");
  if (!issuer || !clientId || !clientSecret) {
    throw new Error("temporary MCP test credentials are not configured");
  }

  const tokenResponse = await fetch(`${issuer}/protocol/openid-connect/token`, {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "client_credentials",
      client_id: clientId,
      client_secret: clientSecret
    })
  });
  const tokenBody = await tokenResponse.json().catch(() => ({}));
  console.log("[oauth-probe]", JSON.stringify({
    test: "client_credentials",
    status: tokenResponse.status,
    tokenType: tokenBody.token_type || null,
    expiresIn: tokenBody.expires_in || null
  }));
  if (!tokenResponse.ok || !tokenBody.access_token) {
    process.exitCode = 2;
    return;
  }

  const claims = decodePayload(tokenBody.access_token);
  console.log("[oauth-probe]", JSON.stringify({
    test: "safe_claims",
    iss: claims.iss || null,
    azp: claims.azp || claims.client_id || null,
    aud: claims.aud || null,
    preferredUsername: claims.preferred_username || null,
    realmRoles: claims.realm_access && claims.realm_access.roles || [],
    resourceAccess: claims.resource_access || {}
  }));

  await call("missing_token", undefined);
  await call("invalid_token", "not-a-jwt");
  await call("service_account", tokenBody.access_token);
})().catch((error) => {
  console.error("[oauth-probe-error]", error && error.message ? error.message : error);
  process.exitCode = 3;
});