// Copyright (c) Tailscale Inc & contributors
// SPDX-License-Identifier: BSD-3-Clause

package cli

import (
	"context"
	"fmt"

	"github.com/peterbourgon/ff/v3/ffcli"
	"tailscale.com/envknob"
)

var idTokenCmd = &ffcli.Command{
	Name:       "id-token",
	ShortUsage: currentCLIName() + " id-token <aud>",
	ShortHelp:  "Fetch an OIDC id-token for the " + currentProductName() + " machine",
	LongHelp:   hidden,
	Exec:       runIDToken,
}

func runIDToken(ctx context.Context, args []string) error {
	if !envknob.UseWIPCode() {
		return fmt.Errorf("%s id-token: works-in-progress require TAILSCALE_USE_WIP_CODE=1 envvar", currentCLIName())
	}
	if len(args) != 1 {
		return fmt.Errorf("usage: %s id-token <aud>", currentCLIName())
	}

	tr, err := localClient.IDToken(ctx, args[0])
	if err != nil {
		return err
	}

	outln(tr.IDToken)
	return nil
}
