import { createDpopClient, createOAuthClient } from '@pdsjs/oauth-client';
import { resolveIdentity } from '#/lib/identity.js';
import { SCOPES } from '#/lib/scopes.js';

const dpop = createDpopClient({ databaseName: 'pdsjs-spaces-ui' });
const client = createOAuthClient({
  dpop,
  requireProtectedResourceMetadata: true,
  resolveIdentity,
  scope: SCOPES.read,
  storagePrefix: 'pdsjs-spaces-ui',
});

/** @typedef {import('@pdsjs/oauth-client/oauth').OAuthSession} Session */

export const authedFetch = client.authedFetch;
export const beginSignIn = client.beginSignIn;
export const clearRenewal = client.clearRenewal;
export const clientId = client.clientId;
export const completeSignIn = client.completeSignIn;
export const currentSession = client.currentSession;
export const onSessionEnded = client.onSessionEnded;
export const renewGrant = client.renewGrant;
export const redirectUri = client.redirectUri;
export const signOut = client.signOut;
export const dpopKeyPair = dpop.dpopKeyPair;
export const dpopProof = dpop.dpopProof;
export const dpopThumbprint = dpop.dpopThumbprint;
export const forgetDpopKey = dpop.forgetDpopKey;
export const nonceFor = dpop.nonceFor;
export const rememberNonce = dpop.rememberNonce;
export const sha256Base64Url = dpop.sha256Base64Url;
export const thumbprint = dpop.thumbprint;

/**
 * @param {Session|null} session
 * @returns {boolean}
 */
export function canWrite(session) {
  return (session?.scope || '').includes('action=create');
}