import { createAuthEngine, SqlAuthStore, type AuthStore } from "@wrnexus/auth";
import { getDb } from "@wrnexus/db";
import { dbPermissionStore } from "@wrnexus/authz/db";
import { ensureCrmWorkspace } from "./workspace.ts";

// Config is imported before the runtime opens its configured database. This
// forwarding store resolves getDb() only when an auth operation actually runs.
const store = new Proxy({} as AuthStore, {
  get(_target, property) {
    const value = Reflect.get(new SqlAuthStore(getDb()), property);
    return typeof value === "function" ? value.bind(new SqlAuthStore(getDb())) : value;
  },
});

export const auth = createAuthEngine({
  store,
  secret: process.env.AUTH_SECRET ?? "northstar-crm-development-secret-change-me",
  issuer: "Northstar CRM",
  onSignedIn(ctx, returnTo) {
    const destination =
      returnTo?.startsWith("/") && !returnTo.startsWith("//") ? returnTo : "/dashboard";
    return Response.redirect(new URL(destination, ctx.url), 303);
  },
  onSignedOut(ctx) {
    return Response.redirect(new URL("/", ctx.url), 303);
  },
  async onSuccessfulSignUp(_ctx, user) {
    await dbPermissionStore(getDb()).assignRole(user.id, "sales-rep");
    await ensureCrmWorkspace(user.id);
    return { autoSignIn: true, redirectTo: "/dashboard" };
  },
});