/**
 * Authentication orchestrator.
 *
 * Verifies an inbound credential, extracts the delegation it carries,
 * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
 * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
 * and returns a generic `Authenticated` result plus the bound view.
 */

import type { FnMap } from '@astrale-os/kernel-client'
import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
import type { Authenticated, CredentialInput } from '@astrale-os/kernel-core'

import { IdentityId, selfGrant } from '@astrale-os/kernel-core'

import type { RemoteIdentityConfig } from './identity.js'

import { bindKernel } from './kernel-client.js'
import { verifyInboundCredential } from './verify.js'

export type AuthenticateResult = {
  authenticated: Authenticated
  kernel: BoundClientSessionView<FnMap> | null
}

/**
 * Verifies an inbound credential and binds a call-back kernel view. The `sub`
 * claim on the outbound credential is the function's own identity, taken from
 * `config.subject` (the function node's path), so the kernel matches an
 * existing function identity instead of provisioning a generic one.
 */
export async function authenticateRequest(
  credential: CredentialInput,
  config: RemoteIdentityConfig,
): Promise<AuthenticateResult> {
  const { verified, issuer, attestation, delegation } = await verifyInboundCredential(
    credential,
    config,
  )

  const authenticated: Authenticated = {
    credential: { raw: credential, verified },
    grant: selfGrant(IdentityId(verified.sub)),
    attestation,
    delegation,
  }

  const kernel = await bindKernel(delegation, issuer, config)

  return { authenticated, kernel }
}