package main

import (
	"context"
	"fmt"
	"log/slog"

	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
)

// buildJWTValidator builds the JWT validator for issuer (nil when issuer is
// empty: JWT auth disabled). Since mcp-chassis v0.7 construction no longer
// fails when OIDC discovery does (mcp-chassis#4): the issuer resolves lazily,
// and until it does a JWT is answered 503-and-retry, not 401. That replaces
// #83's boot-time retry loop (hyperguild#155). An issuer still unresolved at
// boot is logged, so a misconfigured issuer is visible rather than silent.
func buildJWTValidator(ctx context.Context, logger *slog.Logger, issuer, audience string) (*chassisauth.JWTValidator, error) {
	v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
	if err != nil {
		return nil, fmt.Errorf("build jwt validator: %w", err)
	}
	if ok, rerr := v.Ready(ctx); !ok {
		logger.Warn("jwt issuer not resolved at boot; JWTs answer 503 until it is", "issuer", issuer, "err", rerr)
	}
	return v, nil
}