package pier

import (
	"fmt"
	"strings"

	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/pact"
)

// guardRegistry returns the application's pact.MCPGuards registry,
// publishing an empty one when no plugin did (find-or-publish).
func guardRegistry(app *backpack.App) (*pact.MCPGuards, error) {
	if reg, ok := app.Lookup[*pact.MCPGuards](); ok && reg != nil {
		return reg, nil
	}
	reg := pact.NewMCPGuards()
	if err := app.Publish(reg); err != nil {
		return nil, fmt.Errorf("pier: publishing the guard registry: %w", err)
	}
	return reg, nil
}

// frontendGuardName picks the guard provider an OAuth grant's user acts
// under: the one registered provider other than backend. None means OAuth
// identities have no frontend subject (backend tools only, through the
// link); more than one is a boot error, because a grant names no guard.
func frontendGuardName(reg *pact.MCPGuards) (string, error) {
	var names []string
	for _, name := range reg.Names() {
		if name != BackendGuard {
			names = append(names, name)
		}
	}
	switch len(names) {
	case 0:
		return "", nil
	case 1:
		return names[0], nil
	default:
		return "", fmt.Errorf("pier: several frontend guard providers are registered (%s); an OAuth grant can act under exactly one", strings.Join(names, ", "))
	}
}