// WebFinger endpoint (RFC 7033) served at /.well-known/webfinger.
// Points OIDC relying parties (e.g. Tailscale) at the Authentik issuer
// for acct:admin@cloudrite.co.nz.

const WEBFINGER = {
  subject: 'acct:admin@cloudrite.co.nz',
  links: [
    {
      href: 'https://auth.cloudrite.co.nz/application/o/tailscale/',
      rel: 'http://openid.net/specs/connect/1.0/issuer',
    },
  ],
}

export async function GET() {
  return new Response(JSON.stringify(WEBFINGER), {
    headers: {
      // RFC 7033 requires the JRD media type, not application/json.
      'content-type': 'application/jrd+json; charset=utf-8',
      // WebFinger responses are cross-origin fetched by relying parties.
      'access-control-allow-origin': '*',
      'cache-control': 'public, max-age=3600',
    },
  })
}