// import * as oidc from "openid-client";
// import * as dotenv from "dotenv";

// dotenv.config();



// process.env
// const server = new URL("http://localhost:3000");

// // Discover the provider metadata

// // const as = await oidc.discovery(server, "application", undefined, undefined, { execute: [oidc.allowInsecureRequests] });

// // console.dir(as.clientMetadata());

// // // Register a new client
// const client = await oidc.dynamicClientRegistration(server, {
//   redirect_uris: ["http://foo.com"],
//   grant_types: ["authorization_code", "refresh_token"],
//   response_types: ["code"],
//   token_endpoint_auth_method: "client_secret_basic",
// }, undefined, {execute: [oidc.allowInsecureRequests]});

// console.log(client.serverMetadata())
// console.log(client.clientMetadata())

// const state = oidc.randomState();
// const codeVerifier = oidc.randomPKCECodeVerifier();

// const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);

// const authUrl = oidc.buildAuthorizationUrl(as, {
//   client_id: client.client_id,
//   redirect_uri: "http://localhost:4000/callback",
//   response_type: "code",
//   scope: "openid offline_access",
//   state,
//   code_challenge: codeChallenge,
//   code_challenge_method: "S256",
// });


// console.log(Object.getOwnPropertyNames(client));

import * as oid from 'openid-client'

// Prerequisites

let getCurrentUrl!: (...args: any) => URL
let server!: URL // Authorization server's Issuer Identifier URL
let clientId!: string
let clientSecret!: string
/**
 * Value used in the authorization request as redirect_uri pre-registered at the
 * Authorization Server.
 */
let redirect_uri!: string

// End of prerequisites

let config = await oid.discovery(server, clientId, clientSecret)

let code_challenge_method = 'S256'
/**
 * The following (code_verifier and potentially nonce) MUST be generated for
 * every redirect to the authorization_endpoint. You must store the
 * code_verifier and nonce in the end-user session such that it can be recovered
 * as the user gets redirected from the authorization server back to your
 * application.
 */
let code_verifier = oid.randomPKCECodeVerifier()
let code_challenge = await oid.calculatePKCECodeChallenge(code_verifier)
let nonce!: string

{
  // redirect user to as.authorization_endpoint
  let parameters: Record<string, string> = {
    redirect_uri,
    scope: 'openid email',
    code_challenge,
    code_challenge_method,
  }

  /**
   * We cannot be sure the AS supports PKCE so we're going to use nonce too. Use
   * of PKCE is backwards compatible even if the AS doesn't support it which is
   * why we're using it regardless.
   */
  if (!config.serverMetadata().supportsPKCE()) {
    nonce = oid.randomNonce()
    parameters.nonce = nonce
  }

  let redirectTo = oid.buildAuthorizationUrl(config, parameters)

  console.log('redirecting to', redirectTo.href)
  // now redirect the user to redirectTo.href
}

// one eternity later, the user lands back on the redirect_uri
// Authorization Code Grant
let sub: string
let access_token: string
{
  let currentUrl: URL = getCurrentUrl()
  let tokens = await oid.authorizationCodeGrant(config, currentUrl, {
    pkceCodeVerifier: code_verifier,
    expectedNonce: nonce,
    idTokenExpected: true,
  })

  console.log('Token Endpoint Response', tokens)
  ;({ access_token } = tokens)
  let claims = tokens.claims()!
  console.log('ID Token Claims', claims)
  ;({ sub } = claims)
}

// UserInfo Request
{
  let userInfo = await oid.fetchUserInfo(config, access_token, sub)

  console.log('UserInfo Response', userInfo)
}