auth

var ApiKeyClientIdSetting = setting.Setting[uuid.UUID]{
	Env: "MESHSTACK_API_KEY",
	Short: func(envKey string) string {
		return fmt.Sprintf("The client id of a meshStack API key, which mints tokens together with its secret. Also read from %s.", envKey)
	},
	Long: func(envKey string) string {
		return fmt.Sprintf("The client id of a meshStack API key, which mints tokens together with its secret, also read from `%s`.", envKey)
	},
	Parse: setting.ParseTextUnmarshaler[uuid.UUID],
}

var ApiKeyClientSecretSetting = setting.Setting[string]{
	Env: "MESHSTACK_API_SECRET",
	Short: func(envKey string) string {
		return fmt.Sprintf("The client secret belonging to the API key. Also read from %s.", envKey)
	},
	Long: func(envKey string) string {
		return fmt.Sprintf("The client secret belonging to the API key, also read from `%s`.", envKey)
	},
	Parse: setting.ParseText[string],
}

var ApiTokenSetting = setting.Setting[jwt.JWT]{
	Env: "MESHSTACK_API_TOKEN",
	Short: func(envKey string) string {
		return fmt.Sprintf("A meshStack access token to send as it is. Also read from %s.", envKey)
	},
	Long: func(envKey string) string {
		return fmt.Sprintf("A meshStack access token to send as it is, also read from `%s`.\n\n"+
			"The token is minted elsewhere, so nothing renews it and nothing asks for a workspace: it "+
			"already carries the one it was minted for. A building block runner's token is the usual "+
			"one to bring here, to see what a run sees, and such a token may not be allowed to list "+
			"workspaces at all.", envKey)
	},
	Parse: setting.ParseTextUnmarshaler[jwt.JWT],
}