export type SsoMode = "oidc" | "saml";

export type OidcConfiguration = {
  tenantId: string;
  clientId: string;
  clientSecret: string;
  redirectUri: string;
  frontendOrigin: string;
  authorizationEndpoint: string;
  tokenEndpoint: string;
  jwksUri: string;
  issuer: string;
  scopes: string;
};

export const OIDC_COOKIE_NAMES = {
  state: "rh_oidc_state",
  nonce: "rh_oidc_nonce",
  verifier: "rh_oidc_verifier",
} as const;

function getRequiredEnv(name: string) {
  const value = process.env[name]?.trim();

  if (!value) {
    throw new Error(`Missing required environment variable: ${name}`);
  }

  return value;
}

export function getSsoMode(): SsoMode {
  const mode = process.env.SSO_MODE ?? "oidc";

  if (mode !== "oidc" && mode !== "saml") {
    throw new Error("Invalid SSO_MODE. Expected 'oidc' or 'saml'.");
  }

  return mode;
}

export function getOidcConfiguration(): OidcConfiguration {
  const tenantId = getRequiredEnv("ENTRA_TENANT_ID");
  const clientId = getRequiredEnv("ENTRA_CLIENT_ID");
  const clientSecret = getRequiredEnv("ENTRA_CLIENT_SECRET");
  const redirectUri = getRequiredEnv("ENTRA_REDIRECT_URI");
  const frontendOrigin = getRequiredEnv("FRONTEND_ORIGIN");
  const authority = `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}`;

  return {
    tenantId,
    clientId,
    clientSecret,
    redirectUri,
    frontendOrigin,
    authorizationEndpoint: `${authority}/oauth2/v2.0/authorize`,
    tokenEndpoint: `${authority}/oauth2/v2.0/token`,
    jwksUri: `${authority}/discovery/v2.0/keys`,
    issuer: `https://login.microsoftonline.com/${tenantId}/v2.0`,
    scopes: process.env.ENTRA_SCOPES?.trim() || "openid profile email",
  };
}

export function getOidcCookieOptions() {
  const { redirectUri } = getOidcConfiguration();

  return {
    httpOnly: true,
    sameSite: "lax" as const,
    secure: redirectUri.startsWith("https://"),
    path: "/api/auth",
    maxAge: 10 * 60,
  };
}