package dev.ulfrx.recipe.shared

/**
 * Phase 2 OIDC + API configuration shared by client and server (D-11, D-12).
 *
 * Hardcoded for the v1 single-environment per `PITFALLS.md` tech-debt acceptance:
 * the homelab Authentik is the only target, so `BuildConfig`-style Gradle injection
 * is deliberately deferred. The placeholder issuer host (`auth.example.invalid`) is
 * substituted at deploy time by overriding the build at the call site, never by
 * mutating this file in user installs.
 *
 * **Invariants the rest of Phase 2 depends on:**
 * - `OIDC_ISSUER` ends with `/` so JWKS / authorization endpoints can append paths
 *   without double-slash bugs (PITFALLS.md #8 — Authentik is byte-sensitive here).
 * - `OIDC_REDIRECT_URI` is exactly `recipe://callback` — both `iosApp/Info.plist`
 *   `CFBundleURLTypes` and the Android `<intent-filter>` registration must match
 *   byte-for-byte (D-09).
 * - `OIDC_CLIENT_ID` doubles as the JWT `aud` claim value (D-07: single string,
 *   not array). Server-side `withAudience(OIDC_CLIENT_ID)` validates against it.
 */
public object Constants {
    /** Reserved by `composeApp/server` for the local Ktor port (Phase 1). */
    public const val SERVER_PORT: Int = 8080

    /**
     * Base URL the client uses for `/api/v1/...` calls. v1 single environment;
     * staging support is deferred per PITFALLS.md tech-debt acceptance.
     */
    public const val API_BASE_URL: String = "http://192.168.0.106:8080/"

    /**
     * Authentik OIDC issuer. Trailing slash is required (D-11, PITFALLS.md #8).
     * Replace `auth.example.invalid` with the homelab Authentik hostname before
     * shipping a build; the placeholder keeps tests/CI deterministic without
     * leaking real infrastructure into the repo.
     */
    public const val OIDC_ISSUER: String = "https://auth.ulfrx.dev/application/o/recipe-app/"

    /**
     * OAuth2 client_id registered with Authentik. The same value MUST appear as
     * the single-string `aud` claim per D-07.
     */
    public const val OIDC_CLIENT_ID: String = "recipe-app"

    /**
     * Custom URL scheme for the OAuth redirect (D-09). Must match `Info.plist`
     * `CFBundleURLTypes` on iOS and the Android manifest `<intent-filter>` byte
     * for byte. PKCE S256 + Lokksmith state (D-05) make custom-scheme interception
     * non-exploitable; Universal Links / App Links are explicitly deferred.
     */
    public const val OIDC_REDIRECT_URI: String = "recipe://callback"
}
