@kody/workos

import {
	apiKeySetupUrl,
	DEFAULT_API_KEY_SECRET,
	WORKOS_API_HOST,
	WORKOS_DASHBOARD_API_KEYS_URL,
	WORKOS_PORTAL_INTENTS,
} from './setup.ts'
import { listUserSecretNames, resolveSecretName } from './auth.ts'
import type { WorkosAuthInput } from './types.ts'
import { requireRecord } from './types.ts'

export type WorkosAccountInfo = {
	secretName: string
	apiKeySaved: boolean
	setupUrl: string
	requiredHost: string
	dashboardUrl: string
	portalIntents: Array<string>
}

/**
 * Resolve which WorkOS API key secret to use.
 *
 * - `secretName` wins when set
 * - `account: 'work'` → `workosApiKey-work`
 * - `account: 'default'` / `'workos'` / omitted → `workosApiKey`
 *
 * @example
 * import accounts from 'kody:@kody/workos/accounts'
 * const info = await accounts()
 */
export async function accounts(params: WorkosAuthInput = {}): Promise<WorkosAccountInfo> {
	const secretName = resolveSecretName(params)
	const secrets = await listUserSecretNames()
	return {
		secretName,
		apiKeySaved: secrets.has(secretName),
		setupUrl: apiKeySetupUrl(secretName),
		requiredHost: WORKOS_API_HOST,
		dashboardUrl: WORKOS_DASHBOARD_API_KEYS_URL,
		portalIntents: [...WORKOS_PORTAL_INTENTS],
	}
}

export { DEFAULT_API_KEY_SECRET }

/**
 * Resolve which WorkOS API key secret to use.
 * @example
 * import accounts from 'kody:@kody/workos/accounts'
 * const info = await accounts({ account: 'work' })
 */
export default async function accountsEntrypoint(
	params: WorkosAuthInput & Record<string, unknown> = {},
) {
	return accounts(requireRecord(params, 'accounts') as WorkosAuthInput)
}