package web

import (
	"net/http"
)

// tokensPath is the page at tokens.sr.ht this service points a human at. SPEC
// ch. 7 pins it: the daemon serves one page, `/tokens`, behind the unified-login
// cookie, and "services со временем просто ссылаются сюда" — which is what this
// handler is.
const tokensPath = "/tokens"

// handleTokens sends a human to tokens.sr.ht.
//
// This route used to be spec's own agent-credential page: mint (shown once),
// list, revoke, all against the agent_token table. That table is gone and
// issuance is centralised, so what is left of the route is the one thing it can
// still honestly do — point at the place that issues the credential — and it is
// a redirect rather than a page of prose because an operator who typed /tokens
// wants the form, not an explanation of where the form moved to.
//
// No principal check. The old page was owner-only because it listed and minted
// credentials; a redirect exposes nothing but a public origin already in the
// nav, and tokens.sr.ht authenticates its own page against the same
// unified-login cookie this service reads. Sending an anonymous browser through
// meta's login first would only add a round trip to the same destination.
//
// A 303 rather than a 301: the destination of this route is an instance
// configuration value, and a permanent redirect is cached by browsers for far
// longer than a config key stays true.
func (s *Server) handleTokens(w http.ResponseWriter, r *http.Request) {
	if s.tokensOrigin == "" {
		// An instance with no [tokens.sr.ht] origin has no page to send anybody
		// to, and inventing one would land the operator on a dead host. It is
		// also not a state this daemon can serve agents in — service.New refuses
		// to build the agent plane without that origin — so the page says what is
		// actually wrong.
		s.renderError(w, r, http.StatusServiceUnavailable,
			"agent credentials are issued by tokens.sr.ht, and this instance's config.ini "+
				"has no [tokens.sr.ht] origin")
		return
	}
	http.Redirect(w, r, s.tokensOrigin+tokensPath, http.StatusSeeOther)
}