// Signs each request with the key bound to the token. The authorizer compares its public key with the
// token's `dpop_jkt` claim and refuses a missing proof even when the access token is otherwise valid.

import { createDpopProof } from './dpop';
import { dpopKeyStore } from './dpopKeyStore';

export const DPOP_HEADER = 'DPoP';

/**
 * The DPoP header for one request, or an empty object when this browser holds no key.
 *
 * Returns a HEADER OBJECT rather than a string so the caller spreads it - an absent proof then adds
 * nothing at all, instead of adding `DPoP: undefined`, which some fetch implementations serialise as the
 * literal string "undefined" and the server would then read as a malformed proof.
 */
export async function dpopHeaderFor(method: string, url: string): Promise<Record<string, string>> {
    try {
        const keyPair = await dpopKeyStore.current();
        if (!keyPair) return {};
        return { [DPOP_HEADER]: await createDpopProof({ keyPair, method, url }) };
    } catch {
        // The authorizer rejects the resulting request through its normal authentication path.
        return {};
    }
}