//! Arguments for `mcptest login`.

use clap::Args;

/// Arguments for `mcptest login`.
///
/// The flow needs a base URL whose `.well-known/oauth-authorization-server`
/// resolves to the IdP. The operator can name a server from `mcptest.yml`
/// (positional `[server]`), pass `--url` directly, omit both (interactive
/// picker over configured servers), or pass `--all` to walk every URL
/// server in the config. `--no-browser` is the CI/headless escape hatch;
/// the loopback listener still spins up so the operator can paste the URL
/// into a real browser elsewhere. `--force` evicts any cached token and
/// DCR client metadata so the next call re-runs the full dance.
#[derive(Debug, Args, Default)]
pub struct LoginArgs {
    /// Optional named server from `mcptest.yml` to log in to. Mutually
    /// exclusive with `--url` and `--all`. When omitted, the command
    /// either runs the single configured URL server or shows an
    /// interactive picker over the configured set.
    #[arg(value_name = "SERVER", conflicts_with_all = ["url", "all"])]
    pub server: Option<String>,

    /// Server URL to authenticate against. Bypasses YAML resolution
    /// entirely; useful for ad-hoc logins against a URL that is not
    /// recorded in `mcptest.yml`.
    #[arg(long = "url", value_name = "URL", conflicts_with = "all")]
    pub url: Option<String>,

    /// Fallback OAuth `client_id` for IdPs that do not advertise a
    /// `registration_endpoint`. When DCR is available this value is
    /// ignored.
    #[arg(long = "client-id", value_name = "ID")]
    pub client_id: Option<String>,

    /// Log in to every configured URL server in `mcptest.yml`, in
    /// declaration order. Servers that are stdio (`command:`) are
    /// skipped with a warning.
    #[arg(long = "all")]
    pub all: bool,

    /// Clear any cached token and DCR client metadata for the target
    /// server before running the flow. Use when an upstream IdP
    /// rotates a client or revokes a session.
    #[arg(long = "force")]
    pub force: bool,

    /// Skip opening the browser and print the authorization URL on
    /// stdout instead. The loopback listener still accepts the
    /// callback. Used in CI and integration tests.
    #[arg(long = "no-browser")]
    pub no_browser: bool,

    /// Use the RFC 8628 device-code grant (WOR-1286): print a
    /// verification URL plus user code, then poll the token endpoint
    /// until a human approves on another device. For SSH boxes and
    /// containers with no local browser; requires the IdP to advertise
    /// `device_authorization_endpoint`. Conflicts with `--no-browser`
    /// because the device grant has no loopback callback to wait on.
    #[arg(long = "device", conflicts_with = "no_browser")]
    pub device: bool,
}
