/**
 * Serves what other gerbeur instances read about this one before federated
 * sign-in, at the root paths OpenID Connect fixes, which are the one
 * exception to the API's `/api/` rule. `remote/gerbeur-instance.ts` reads
 * them on the other side.
 *
 * - `GET /.well-known/openid-configuration` — public. Answers the instance's
 *   metadata (`InstanceMetadata`): its endpoints, its name and the protocol's
 *   version. Bare JSON, not the API's envelope.
 * - `GET /.well-known/jwks.json` — public. Answers the public keys its tokens
 *   are signed with. Bare JSON.
 *
 * @module
 */

import { Router } from "@oak/oak";
import { getInstanceMetadata } from "../services/identity-provider-service.ts";
import { getPublicKeys } from "../services/instance-key-service.ts";

/**
 * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
 * An `APIException` thrown by a handler becomes the JSON error response there.
 */
const router: Router = new Router({ prefix: "/.well-known" });

router.get("/openid-configuration", (ctx) => {
  ctx.response.headers.set("Cache-Control", "public, max-age=600");
  ctx.response.body = getInstanceMetadata();
});

router.get("/jwks.json", async (ctx) => {
  ctx.response.headers.set("Cache-Control", "public, max-age=600");
  ctx.response.body = await getPublicKeys();
});

export default router;