import { sign } from '@@/jwt';
import { PORT, OFFICER_API_URL } from '../../officer-url.mjs';

const { PUBLIC_URL } = process.env;

const PUBLIC_HOST = (() => {
  try {
    return PUBLIC_URL ? new URL(PUBLIC_URL).host : undefined;
  } catch {
    return undefined;
  }
})();

type TaskApiUser = { id: number; email: string; username?: string | null };

// Environment that lets a script task call Officer's own API instead of reimplementing server-side
// work (transcription, for one — `plugins/transcribe/tasks/transcribe-audio-file/index.ts` uses exactly
// this to reach the transcribe plugin's own route rather than talking to Whisper itself).
//
// Requests go to 127.0.0.1 so a task never depends on DNS or the reverse proxy being up. Origin
// validation matches the Host header against PUBLIC_URL though, so a bare localhost request is
// rejected — hence OFFICER_API_HOST, which scripts must pass as an explicit Host header:
//
//   curl -H "Authorization: Bearer $OFFICER_AUTH_TOKEN" -H "Host: $OFFICER_API_HOST" \
//        "$OFFICER_API_URL/api/transcribe/transcribe"
export async function buildTaskApiEnv(user: TaskApiUser): Promise<Record<string, string>> {
  const token = await sign({ id: user.id, email: user.email, username: user.username ?? '' }, '12h');
  return {
    OFFICER_API_URL,
    OFFICER_API_HOST: PUBLIC_HOST ?? `127.0.0.1:${PORT}`,
    OFFICER_AUTH_TOKEN: token,
  };
}