<?php

/**
 * Mints an MCP access token for a user, exactly like mcp-oauth's TokenEndpoint
 * does after a completed OAuth flow. For local integration tests only.
 *
 * Usage: wp eval-file tests/Integration/mint-token.php <user_login>
 *
 * Note: no `declare(strict_types=1);` here — PHP forbids that declaration
 * inside eval()'d code, and `wp eval-file` runs this file through eval().
 * Confirmed with a minimal repro during Task 7 (see task-7-report.md).
 */

defined('WP_CLI') && WP_CLI || exit;

use WPMedia\MCP\OAuth\Auth\JWT;
use WPMedia\MCP\OAuth\Auth\SecretManager;

$login = $args[0] ?? '';
$user = get_user_by('login', $login);
if (! $user) {
    fwrite(STDERR, "unknown user {$login}\n");
    exit(1);
}

[, $item] = WP_Application_Passwords::create_new_application_password(
    $user->ID,
    ['name' => 'lit-mcp-integration-test', 'app_id' => 'lit-mcp-integration-test']
);

$now = time();
echo JWT::encode([
    'iss' => home_url(),
    'aud' => get_rest_url(null, 'mcp/mcp-oauth-server'),
    'sub' => (string) $user->ID,
    'app_pass_id' => $item['uuid'],
    'client_id' => 'lit-mcp-integration-test',
    'scope' => 'mcp',
    'iat' => $now,
    'exp' => $now + 600,
], SecretManager::get_secret());