import { awsSignedFetch } from './client.ts'
import { xmlTag } from './validation.ts'
import type { AwsAuthOptions } from './validation.ts'

export type CallerIdentity = {
	ok: true
	account: string | null
	arn: string | null
	userId: string | null
	region: string
}

/**
 * Read the caller identity via STS GetCallerIdentity.
 *
 * Returns account, ARN, and user id only — never access keys or secret material.
 *
 * @example
 * import { getCallerIdentity } from 'kody:@kody/aws/identity'
 * const identity = await getCallerIdentity({ region: 'us-east-1' })
 */
export async function getCallerIdentity(
	params: AwsAuthOptions = {},
): Promise<CallerIdentity> {
	const result = await awsSignedFetch({
		...params,
		service: 'sts',
		method: 'POST',
		path: '/',
		headers: {
			'content-type': 'application/x-www-form-urlencoded',
		},
		body: 'Action=GetCallerIdentity&Version=2011-06-15',
	})

	return {
		ok: true,
		account: xmlTag(result.text, 'Account'),
		arn: xmlTag(result.text, 'Arn'),
		userId: xmlTag(result.text, 'UserId'),
		region: result.region,
	}
}

export default getCallerIdentity