// ---------------------------------------------------------------------------
// The `/api/*` plane's WorkOS device-login (user_management) JWT bearer config.
//
// The protected HTTP API accepts THREE credential forms on the `Authorization`
// header, in this precedence: a WorkOS device-login access token (JWT, from
// `executor login`), then a WorkOS API key, then, with no header, the
// sealed-session cookie. This module supplies the JWKS the JWT branch verifies
// against.
//
// CRITICAL: a device-login token is a WorkOS *user_management* access token,
// signed by the SSO keyset served at `<workos-api>/sso/jwks/<clientId>` with NO
// audience and a user_management issuer. That is a DIFFERENT key domain than the
// MCP `/oauth2` tokens (verified via the AuthKit `/oauth2/jwks`): the device
// token's key is not in the oauth2 JWKS, so we must verify it against the
// client-scoped SSO JWKS instead (signature + expiry; see
// `verifyWorkosUserManagementToken`). `WORKOS_API_URL` is api.workos.com in
// production and the WorkOS emulator in tests.
// ---------------------------------------------------------------------------

import { env } from "cloudflare:workers";

import { createCachedRemoteJWKSet } from "./jwks-cache";
import type { JwtBearerConfig } from "./workos-auth-provider";

const WORKOS_API_BASE = (env.WORKOS_API_URL ?? "https://api.workos.com").replace(/\/+$/, "");

// Module-scope cache, same rationale as `mcp/auth.ts`: one JWKS fetch per
// isolate-hour rather than one per cold isolate.
export const workosApiJwtBearerConfig: JwtBearerConfig = {
  jwks: createCachedRemoteJWKSet(new URL(`${WORKOS_API_BASE}/sso/jwks/${env.WORKOS_CLIENT_ID}`)),
};