/**
 * OIDC Token Exchange routes.
 *
 * Provides the unauthenticated POST /oidc/token endpoint used by GitHub Actions
 * workflows to exchange a GitHub OIDC JWT for a SentryAgent.ai access token.
 *
 * This route is intentionally unauthenticated — the GitHub OIDC JWT IS the
 * authentication credential. Trust-policy enforcement is performed inside the
 * controller.
 *
 * Mount this router at `/api/v1/oidc` in app.ts alongside the trust-policy router.
 */

import { Router } from 'express';
import { OIDCTokenExchangeController } from '../controllers/OIDCTokenExchangeController.js';
import { asyncHandler } from '../utils/asyncHandler.js';

/**
 * Creates and returns the Express router for the OIDC token exchange endpoint.
 *
 * @param controller - The OIDC token exchange controller instance.
 * @returns Configured Express router with a single POST /token route.
 */
export function createOIDCTokenExchangeRouter(
  controller: OIDCTokenExchangeController,
): Router {
  const router = Router();

  // POST /oidc/token — exchange a GitHub OIDC JWT for a SentryAgent.ai access token
  // Unauthenticated: the GitHub OIDC token serves as the credential.
  router.post(
    '/token',
    asyncHandler(controller.exchangeToken.bind(controller)),
  );

  return router;
}
