// Force a human approval screen on every MCP OAuth connection.
//
// Better Auth's MCP authorize endpoint only shows the consent page when the
// request carries `prompt=consent` (it otherwise auto-issues an authorization
// code — see better-auth/plugins/mcp/authorize). MCP clients don't send that,
// so a connecting client would be granted a token with no human approval. This
// wraps Better Auth's web handler and adds `consent` to the `prompt` of every
// `GET /api/auth/mcp/authorize`, so — paired with `oidcConfig.consentPage` —
// every connect is gated on the `/oauth/consent` approval screen.
//
// Pure + Effect-free; the wrapper is a plain Request -> Request transform so it
// composes with whatever serves the Better Auth handler (prod + vite dev both
// mount the same handler).

const AUTHORIZE_PATH = "/api/auth/mcp/authorize";
const CONSENT_PAGE = "/mcp-consent";

/** Merge `consent` into a possibly-empty space-separated `prompt` value. */
export const promptWithConsent = (prompt: string | null): string => {
  const set = new Set((prompt ?? "").split(/\s+/).filter((value) => value.length > 0));
  set.add("consent");
  return Array.from(set).join(" ");
};

/**
 * Return the MCP-authorize request with `prompt=consent` ensured, or the
 * original request unchanged when it isn't an MCP authorize call.
 */
export const withForcedMcpConsent = (request: Request): Request => {
  if (request.method !== "GET") return request;
  const url = new URL(request.url);
  if (url.pathname !== AUTHORIZE_PATH) return request;
  const prompt = url.searchParams.get("prompt");
  if (prompt && prompt.split(/\s+/).includes("consent")) return request;
  url.searchParams.set("prompt", promptWithConsent(prompt));
  return new Request(url, request);
};

/**
 * If `location` is Better Auth's redirect to the consent page carrying a
 * `client_id` but no `client_name`, return that client id (so the caller can
 * look up the registered name and enrich the redirect). Otherwise null.
 * Better Auth's authorize only puts the opaque `client_id` on the consent
 * redirect; the registered name makes the approval screen legible.
 */
export const consentRedirectClientId = (location: string | null): string | null => {
  if (!location) return null;
  const url = new URL(location, "http://host.internal");
  if (url.pathname !== CONSENT_PAGE) return null;
  if (url.searchParams.get("client_name")) return null;
  return url.searchParams.get("client_id");
};

/** Append `client_name` to a consent-page redirect URL (path + query only). */
export const withClientName = (location: string, clientName: string): string => {
  const url = new URL(location, "http://host.internal");
  url.searchParams.set("client_name", clientName);
  return `${url.pathname}${url.search}`;
};