// Package authd — jwkshared.go: helper for services that only need
// the JWT verifier side of authd (not the full IdP). routerd,
// archiverd, deliverd-*, admind all use this to construct the
// Authd from env vars without repeating the JWTSecret / Issuer
// setup in each cmd/.
//
// Threading: NewFromEnv is safe to call once at startup; the
// returned *Authd is safe for concurrent use.
package authd

import (
	"errors"
	"fmt"
	"os"
	"time"
)

// NewFromEnv constructs an Authd for use as a JWT verifier only.
// It reads:
//
//	BA_AUTHD_JWT_SECRET   (required)
//	BA_AUTHD_ISSUER       (default "broad-announce")
//
// AccessTokenTTL is set to 1 minute as a placeholder; this Authd
// never issues tokens (no pool is set), so the TTL is unused. The
// VerifyAccessToken call only needs JWTSecret + Issuer.
func NewFromEnv() (*Authd, error) {
	secret := os.Getenv("BA_AUTHD_JWT_SECRET")
	if secret == "" {
		return nil, errors.New("authd: BA_AUTHD_JWT_SECRET is required for JWT verification")
	}
	issuer := os.Getenv("BA_AUTHD_ISSUER")
	if issuer == "" {
		issuer = "broad-announce"
	}
	cfg := Config{
		JWTSecret:      []byte(secret),
		Issuer:         issuer,
		AccessTokenTTL: 1 * time.Minute, // placeholder, not used
	}
	return New(nil, cfg)
}

// MustNewFromEnv is like NewFromEnv but panics on error. Use only
// in main() where a config error is a fatal startup failure.
func MustNewFromEnv() *Authd {
	a, err := NewFromEnv()
	if err != nil {
		panic(fmt.Sprintf("authd: %v", err))
	}
	return a
}

// EnvEnabled reports whether BA_AUTHD_JWT_SECRET is set. Services
// that wire the gate conditionally use this to decide whether to
// register the JWT-protected routes. When false, the original
// unauthenticated routes stay as-is (backward compatible).
func EnvEnabled() bool {
	return os.Getenv("BA_AUTHD_JWT_SECRET") != ""
}