// ---------------------------------------------------------------------------
// Bearer credential parsing — single-sourced HTTP `Authorization: Bearer …`
// prefix, and the ONE place the token is sliced off the header.
//
// Shared by every cloud credential path that splits a bearer token off the
// `Authorization` header (the WorkOS api-key/session resolver and the MCP edge
// auth). Defined once so the literal cannot drift.
//
// The slice hands back a `Redacted`, so no call site ever holds the inbound
// credential as a bare string. The header shapes the callers tell apart are
// enumerated as outcomes rather than folded into a nullable string: `Absent`
// falls through to the cookie session, `NotBearer` and `Empty` are distinct
// rejections, and `Redacted.make("")` is truthy — a caller could not test an
// empty token for itself once it is wrapped.
// ---------------------------------------------------------------------------

import { Predicate, Redacted } from "effect";

export const BEARER_PREFIX = "Bearer ";

export type BearerCredential =
  | { readonly _tag: "Absent" }
  | { readonly _tag: "NotBearer" }
  | { readonly _tag: "Empty" }
  | { readonly _tag: "Present"; readonly token: Redacted.Redacted<string> };

/** Narrows to the one outcome that carries a token, so a call site reaches
 *  `token` only after proving it exists. */
export const isBearerPresent = Predicate.isTagged("Present");

/** The bearer credential an inbound request carries, wrapped as it is sliced. */
export const bearerCredential = (request: Request): BearerCredential => {
  const header = request.headers.get("authorization");
  if (!header) return { _tag: "Absent" };
  if (!header.startsWith(BEARER_PREFIX)) return { _tag: "NotBearer" };
  const token = header.slice(BEARER_PREFIX.length).trim();
  if (!token) return { _tag: "Empty" };
  return { _tag: "Present", token: Redacted.make(token) };
};

/** Whether a bearer credential is a WorkOS access-token JWT (three dot-separated
 *  segments) rather than an API key — the discriminator BOTH bearer planes
 *  dispatch on. Reads the plaintext to count segments and retains none of it,
 *  so the call sites stay `Redacted`-only. */
export const isJwtBearer = (token: Redacted.Redacted<string>): boolean =>
  // oxlint-disable-next-line executor/no-redacted-unwrap -- boundary: the shape of the credential is the dispatch key; only the segment count escapes
  Redacted.value(token).split(".").length === 3;