using Microsoft.AspNetCore.Mvc;

using PrivaPub.Api.Mastodon.Infrastructure;
using PrivaPub.Api.Mastodon.Mappers;
using PrivaPub.Federation.Actors;

namespace PrivaPub.Api.Mastodon.Controllers
{
	// Mastodon 4.4's OAuth userinfo (OpenID Connect's shape, GET or POST, the `profile` scope): who the token's persona is,
	// for a site that signs in with it. Only what its public account says already; never its login. The authorization
	// server's metadata names it (OAuthSetup).
	public class UserinfoController : MastodonController
	{
		public const string Path = "/oauth/userinfo";

		readonly MastodonMapper _mapper;
		readonly ILocalActorService _localActors;

		public UserinfoController(MastodonMapper mapper, ILocalActorService localActors)
		{
			_mapper = mapper;
			_localActors = localActors;
		}

		[HttpGet(Path), HttpPost(Path), Scope("profile")]
		public async Task<IActionResult> Show(CancellationToken token)
		{
			var account = await _mapper.Local(Me, false, token);
			return Json(new
			{
				iss = _localActors.BaseAddress + "/",
				sub = Me.Uri,
				name = account.DisplayName,
				preferred_username = account.Username,
				profile = account.Url,
				picture = account.Avatar
			});
		}
	}
}