first

Controllers/MetaController.cs

@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Mvc;
+using Csob.Configuration;
+
+namespace Csob.Controllers;
+
+/// <summary>Service metadata endpoints. These do not require ČSOB credentials.</summary>
+[ApiController]
+[Produces("application/json")]
+[Tags("Meta")]
+public sealed class MetaController : ControllerBase
+{
+    private readonly CsobSettings _settings;
+
+    public MetaController(CsobSettings settings) => _settings = settings;
+
+    /// <summary>Liveness probe.</summary>
+    [HttpGet("/health")]
+    public IActionResult Health() => Ok(new { status = "ok" });
+
+    /// <summary>Service name, version and the configured upstream endpoints (no secrets).</summary>
+    [HttpGet("/version")]
+    public IActionResult Version() => Ok(new
+    {
+        app = _settings.AppName,
+        version = _settings.AppVersion,
+        language = "dotnet",
+        api = "ČSOB PSD2 (Czech Open Banking Standard / COBS)",
+        root_path = _settings.RootPath,
+    });
+
+    /// <summary>
+    /// Reports the non-secret configuration. This service is stateless and multi-tenant: it holds
+    /// no credentials, so there is nothing per-client to report — every secret is supplied per
+    /// request via headers.
+    /// </summary>
+    [HttpGet("/status")]
+    public IActionResult Status() => Ok(new
+    {
+        stateless = true,
+        api_base_url = _settings.ApiBaseUrl,
+        oauth_authorize_url = _settings.OAuthAuthorizeUrl,
+        oauth_token_url = _settings.OAuthTokenUrl,
+        request_timeout_seconds = _settings.RequestTimeoutSeconds,
+    });
+}