/**
 * 启动自检(手册第 5 步;ADR-012):拉 `.well-known/openid-configuration`,
 * issuer 与本地拼出来的不一致就别起 —— 配错了每个请求都 401 还查不出原因,不如启动时就说清楚。
 */
import type { KeycloakConfig } from './config.ts';

export async function checkKeycloakConnection(
  kc: KeycloakConfig,
  fetchImpl: typeof fetch = fetch,
): Promise<{ issuer: string; clientId: string }> {
  const url = `${kc.issuer}/.well-known/openid-configuration`;
  const resp = await fetchImpl(url, { signal: AbortSignal.timeout(5000) });
  if (!resp.ok) throw new Error(`拉取发现文档失败 (${resp.status}): ${url}`);
  const conf = (await resp.json()) as { issuer?: unknown };
  if (conf.issuer !== kc.issuer) {
    throw new Error(
      `issuer 不一致!\n  期望: ${kc.issuer}\n  实际: ${String(conf.issuer)}\n` +
        '  → Keycloak 的 KC_HOSTNAME 配错了,或本服务的 KEYCLOAK_URL 写错了',
    );
  }
  return { issuer: kc.issuer, clientId: kc.clientId };
}