/**
 * OIDC routes — discovery document, JWKS endpoint, and agent-info.
 * /.well-known/openid-configuration and /.well-known/jwks.json are registered at app root.
 * /agent-info is protected by authMiddleware.
 *
 * Mount this router at `/` in app.ts so that `/.well-known/*` paths work at the root level.
 */

import { Router, RequestHandler } from 'express';
import { OIDCController } from '../controllers/OIDCController.js';
import { asyncHandler } from '../utils/asyncHandler.js';

/**
 * Creates and returns the Express router for OIDC endpoints.
 * Mount at `/` (root) so that well-known paths resolve correctly.
 *
 * @param controller - The OIDC controller instance.
 * @param authMiddleware - The JWT authentication middleware for protected endpoints.
 * @returns Configured Express router.
 */
export function createOIDCRouter(
  controller: OIDCController,
  authMiddleware: RequestHandler,
): Router {
  const router = Router();

  // GET /.well-known/openid-configuration — unauthenticated OIDC discovery document
  router.get(
    '/.well-known/openid-configuration',
    asyncHandler(controller.getDiscoveryDocument.bind(controller)),
  );

  // GET /.well-known/jwks.json — unauthenticated JWKS (public keys for ID token verification)
  router.get(
    '/.well-known/jwks.json',
    asyncHandler(controller.getJWKS.bind(controller)),
  );

  // GET /agent-info — protected; returns agent identity claims for the authenticated caller
  router.get(
    '/agent-info',
    authMiddleware,
    asyncHandler(controller.getAgentInfo.bind(controller)),
  );

  return router;
}
