package main

import (
	"context"
	"log/slog"

	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"

	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
)

// buildJWTValidator runs OIDC discovery under policy, so a 502 from an auth
// upstream that is not serving yet on a cold boot is retried instead of
// exiting (#83). It honours ctx between attempts.
func buildJWTValidator(
	ctx context.Context, logger *slog.Logger, issuer, audience string, policy startupretry.Policy,
) (*chassisauth.JWTValidator, error) {
	return startupretry.Do(ctx, policy, func(ctx context.Context) (*chassisauth.JWTValidator, error) {
		v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
		if err != nil {
			logger.Warn("oidc discovery not ready, retrying", "err", err)
		}
		return v, err
	})
}