// shared/lib/auth/config.ts — 认证配置工厂（各站点统一使用）
import type { AuthConfig } from './types'

export interface SiteAuthConfig {
  /** 站点名称，用于日志和调试 */
  siteName: string
  /** 本地 cookie 名（如 'session_issue'），不设则不使用本地 cookie 回退 */
  localCookieName?: string
  /** 需要 admin 权限的路径前缀，默认 ['/admin'] */
  adminPaths?: string[]
  /** 公开路径（不需要认证），默认 ['/login', '/api/auth', '/api/health', '/_next', '/favicon.ico'] */
  publicPaths?: string[]
  /** OIDC client ID，默认 `${siteName}-oidc`，可手动覆盖 */
  oidcClientId?: string
  /** OIDC client secret，默认从 OIDC_CLIENT_SECRET 环境变量读取 */
  oidcClientSecret?: string
  /** OIDC redirect URI，默认从 OIDC_REDIRECT_URI 环境变量读取 */
  oidcRedirectUri?: string
  /** 启用 API Key 认证（读取 ALLOWED_API_KEYS 环境变量），默认 false */
  enableApiKey?: boolean
}

/**
 * 创建统一的认证配置
 *
 * @example
 * ```ts
 * // src/lib/auth-config.ts
 * import { createAuthConfig } from '@shared/lib/auth/config'
 * export const authConfig = createAuthConfig({
 *   siteName: 'issue-ai',
 *   localCookieName: 'session_issue',
 *   adminPaths: ['/settings'],
 *   enableApiKey: true,
 * })
 * ```
 */
export function createAuthConfig(site: SiteAuthConfig): AuthConfig & {
  localCookieName?: string
  enableApiKey?: boolean
} {
  return {
    jwtSecret: process.env.JWT_SECRET || 'default-secret-change-me',
    cookieDomain: process.env.COOKIE_DOMAIN || '',
    autheliaUrl: process.env.AUTHELIA_URL || 'https://127.0.0.1:6180',
    oidcClientId: site.oidcClientId || process.env.OIDC_CLIENT_ID || `${site.siteName}-oidc`,
    oidcClientSecret: site.oidcClientSecret || process.env.OIDC_CLIENT_SECRET || '',
    oidcRedirectUri: site.oidcRedirectUri || process.env.OIDC_REDIRECT_URI || '',
    ldapUrl: process.env.LDAP_URL || 'ldap://localhost:3890',
    publicPaths: site.publicPaths || ['/login', '/api/auth', '/api/health', '/_next', '/favicon.ico'],
    adminPaths: site.adminPaths || ['/admin'],
    localCookieName: site.localCookieName,
    enableApiKey: site.enableApiKey || false,
  }
}