<?php

declare(strict_types=1);

namespace Plugin\tnt_mcp\src\Mcp\OAuth;

use Plugin\tnt_mcp\src\Mcp\ToolFactory;

/**
 * Single source of truth for the OAuth scope universe. It is derived from the enabled MCP tools
 * ({@see ToolFactory}) so the scopes advertised in discovery metadata, granted by default to the
 * shop identity, and enforced per-tool by the guard can never drift apart. Because the shop is one
 * identity acting for itself, the default granted set is simply "every scope the tools define".
 */
final class ScopeCatalog
{
    /**
     * All scopes the server understands, sorted + de-duplicated.
     *
     * @return list<non-empty-string>
     */
    public static function all(): array
    {
        $scopes = [];
        foreach (ToolFactory::enabledTools() as $tool) {
            $scope = $tool->scope();
            if ($scope !== '' && !\in_array($scope, $scopes, true)) {
                $scopes[] = $scope;
            }
        }
        sort($scopes);

        return $scopes;
    }

    public static function knows(string $scope): bool
    {
        return \in_array($scope, self::all(), true);
    }

    /** Space-delimited default scope string granted when a client requests none. */
    public static function defaultScope(): string
    {
        return implode(' ', self::all());
    }
}
