#!/usr/bin/env python3
"""Minimal OIDC authorization-server stub for mcp-toolbox generic authService.

Serves:
  /.well-known/openid-configuration  -> issuer + jwks_uri (+ introspection)
  /jwks                              -> empty JWKS document (no token is ever
                                        presented by the repro, so no keys are
                                        needed; toolbox only fetches this at
                                        startup for the background keyfunc)
  /introspect                        -> RFC 7662 style response (unused)

Every request is logged to stderr so the repro log proves the toolbox server
actually discovered this authorization server at startup.
"""
import json
import sys
from http.server import BaseHTTPRequestHandler, HTTPServer

HOST = "127.0.0.1"


class Handler(BaseHTTPRequestHandler):
    def _send_json(self, obj):
        body = json.dumps(obj).encode()
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def do_GET(self):
        sys.stderr.write(f"oidc-stub GET {self.path}\n")
        sys.stderr.flush()
        base = f"http://{HOST}:{self.server.server_port}"
        if self.path == "/.well-known/openid-configuration":
            self._send_json({
                "issuer": base,
                "jwks_uri": f"{base}/jwks",
                "introspection_endpoint": f"{base}/introspect",
            })
        elif self.path == "/jwks":
            self._send_json({"keys": []})
        else:
            self.send_response(404)
            self.end_headers()

    def do_POST(self):
        sys.stderr.write(f"oidc-stub POST {self.path}\n")
        sys.stderr.flush()
        length = int(self.headers.get("Content-Length", "0") or "0")
        if length:
            self.rfile.read(length)
        if self.path == "/introspect":
            self._send_json({"active": False})
        else:
            self.send_response(404)
            self.end_headers()

    def log_message(self, fmt, *args):  # silence default access log
        pass


def main():
    port = int(sys.argv[1]) if len(sys.argv) > 1 else 8099
    server = HTTPServer((HOST, port), Handler)
    sys.stderr.write(f"oidc-stub listening on http://{HOST}:{port}\n")
    sys.stderr.flush()
    server.serve_forever()


if __name__ == "__main__":
    main()