"""Solution for the MCP Inspector practice."""
import base64
import json
import re


def resource_metadata_url(www_authenticate: str) -> str | None:
    m = re.search(r'resource_metadata="([^"]+)"', www_authenticate or "")
    return m.group(1) if m else None


def how_to_get_a_token(as_metadata: dict) -> str:
    if as_metadata.get("authorization_endpoint") and "code" in as_metadata.get("response_types_supported", []):
        return "browser sign-in"
    if "client_credentials" in as_metadata.get("grant_types_supported", []):
        return "client credentials"
    return "none"


def decode_claims(token: str) -> dict:
    part = token.split(".")[1]
    part += "=" * (-len(part) % 4)
    return json.loads(base64.urlsafe_b64decode(part))


def token_problems(claims: dict, now: int, resource: str, needed_scope: str) -> list[str]:
    problems = []
    if not claims.get("org_id"):
        problems.append("no tenant")
    if claims.get("aud") != resource:
        problems.append("wrong audience")
    if claims.get("exp", 0) <= now:
        problems.append("expired")
    if needed_scope not in claims.get("scope", "").split():
        problems.append(f"missing {needed_scope}")
    return problems