import { WachtClient } from "@wacht/backend";

const client = new WachtClient({
  apiKey: process.env.WACHT_BACKEND_API_KEY!,
});

export async function verifyOAuthRequest(token: string, method: string, resource: string) {
  const authz = await client.gateway.verifyOauthAccessTokenRequest(token, method, resource, {
    requiredPermissions: ["mcp:invoke"],
  });

  return {
    clientId: authz.headers["x-wacht-oauth-client-id"],
    grantedResource: authz.headers["x-wacht-granted-resource"],
    oauthResource: authz.metadata?.oauth_resource,
    scopes: authz.metadata?.scopes || [],
    expiresAt: authz.metadata?.expires_at,
  };
}

use wacht::{WachtClient, WachtConfig};
use wacht::gateway::{GatewayAuthzOptions, GatewayPrincipalType};

let api_key = std::env::var("WACHT_BACKEND_API_KEY").expect("WACHT_BACKEND_API_KEY is required");
let frontend_host = std::env::var("WACHT_FRONTEND_HOST").expect("WACHT_FRONTEND_HOST is required");
let client = WachtClient::new(WachtConfig::new(api_key, frontend_host)).expect("valid Wacht config");

let authz = client
    .gateway()
    .check_authz_with_principal_type(
        GatewayPrincipalType::OauthAccessToken,
        access_token,
        "POST",
        "mcp",
        GatewayAuthzOptions {
            required_permissions: Some(vec!["mcp:invoke".to_string()]),
            ..Default::default()
        },
    )
    .await?;

if !authz.allowed {
    // Reject request in your framework middleware/handler.
}

let principal = authz.resolve_principal_context();
let scopes = principal.metadata.scopes;
let granted_resource = principal.metadata.granted_resource;

const rotated = await client.oauth.rotateOAuthClientSecret(
  "dep_123",
  "mcp-auth",
  oauthClient.id,
);

client.oauth()
    .revoke_oauth_grant("dep_123", "mcp-auth", &oauth_client.id, grant_id)
    .send()
    .await?;