package io.cameleer.server.app.security;

import java.net.URI;

/**
 * Pure utility — derives a display label for an OIDC provider from its issuer URI.
 * Used by {@link AuthCapabilitiesController} so the SPA can render
 * "Sign in with {providerName}" on the login page.
 *
 * <p>Pattern-match only — never network-discover. If the issuer doesn't match a
 * known vendor pattern, we return the generic "Single Sign-On" label rather than
 * leaking hostnames into the UI.
 */
public final class OidcProviderNameDeriver {

    private static final String GENERIC = "Single Sign-On";

    private OidcProviderNameDeriver() {}

    public static String deriveName(String issuerUri) {
        if (issuerUri == null || issuerUri.isBlank()) {
            return GENERIC;
        }
        String host;
        try {
            URI uri = URI.create(issuerUri.trim());
            host = uri.getHost();
        } catch (IllegalArgumentException e) {
            return GENERIC;
        }
        if (host == null || host.isBlank()) {
            return GENERIC;
        }
        String h = host.toLowerCase();
        if (h.contains("logto")) return "Logto";
        if (h.contains("keycloak")) return "Keycloak";
        if (h.endsWith("auth0.com")) return "Auth0";
        if (h.endsWith("okta.com") || h.endsWith("oktapreview.com")) return "Okta";
        return GENERIC;
    }
}
