// OIDC Attestor — SPIRE WorkloadAttestor plugin.
//
// Runs in SPIRE Agent. Verifies OIDC tokens presented by workloads
// and maps their claims to SPIRE selectors for registration matching.
package main

import (
	"context"
	"log"

	"github.com/hashicorp/go-plugin"
	"google.golang.org/grpc"
)

var handshakeConfig = plugin.HandshakeConfig{
	ProtocolVersion:  1,
	MagicCookieKey:   "ServerAgent",
	MagicCookieValue: "GuildhouseSpire",
}

// OIDCAttestorPlugin implements plugin.GRPCPlugin for the OIDC attestor.
type OIDCAttestorPlugin struct {
	plugin.Plugin
	Impl *OIDCAttestor
}

func (p *OIDCAttestorPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
	log.Println("oidc-attestor: gRPC server registered")
	return nil
}

func (p *OIDCAttestorPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
	return nil, nil
}

func main() {
	attestor := &OIDCAttestor{}

	plugin.Serve(&plugin.ServeConfig{
		HandshakeConfig: handshakeConfig,
		Plugins: map[string]plugin.Plugin{
			"workload_attestor": &OIDCAttestorPlugin{Impl: attestor},
		},
		GRPCServer: plugin.DefaultGRPCServer,
	})
}