/**
 * Auth barrel — re-exports public API from all auth submodules.
 *
 * New code can import from '@/server/auth/index.js' instead of individual files.
 * Existing imports do NOT need to change (barrel is opt-in).
 *
 * Canonical source for each export is the file that defines it, not a re-exporter.
 * session.ts re-exports some cookie symbols — we export those from cookies.ts here
 * to keep a single source of truth and avoid duplicate identifier errors.
 */

// ─── cookies.ts ───────────────────────────────────────────────────────────────
export type { MhPayload, VendorRegPayload } from './cookies.js';
export {
  initialsOf,
  buildMh,
  parseMh,
  setMhCookie,
  clearMhCookie,
  signVendorRegCookie,
  verifyVendorRegCookie,
  isHttpsRequest,
  ACCESS_TOKEN_TTL_SECS,
  buildAccessCookie,
  buildRefreshCookie,
  clearAccessCookie,
  clearRefreshCookie,
  buildCsrfCookieHeader,
} from './cookies.js';

// ─── tokens.ts ────────────────────────────────────────────────────────────────
export type { AccessClaims, FirebaseTokenPayload } from './tokens.js';
export {
  signAccessToken,
  verifyAccessToken,
  generateRefreshToken,
  hashRefreshToken,
  verifyFirebaseIdToken,
} from './tokens.js';

// ─── session.ts ───────────────────────────────────────────────────────────────
export type {
  Session,
  User,
  CreateSessionResult,
  SessionUserInfo,
  RefreshSessionResult,
} from './session.js';
export {
  SESSION_TTL_MS,
  createSession,
  revokeSession,
  revokeSessionByRefreshToken,
  rotateSession,
  getCurrentSession,
  sessionNeedsRotation,
  refreshSessionFromCookie,
  bumpMhVersion,
  bumpSessionVersion,
  revokeAllSessions,
} from './session.js';

// ─── credentials.ts ───────────────────────────────────────────────────────────
export type {
  IssueMagicLinkEnv,
  MagicLinkPreFill,
  ConsumeMagicLinkResult,
  EmailVerificationPurpose,
  CreateTokenOpts,
  CreateTokenResult,
  ConsumeTokenResult,
  WebAuthnCredential,
  WebAuthnChallengeRecord,
  WebAuthnVerifyRegistrationResult,
  WebAuthnVerifyAuthenticationResult,
} from './credentials.js';
export {
  MagicLinkError,
  hashPassword,
  updatePassword,
  verifyPassword,
  issueMagicLink,
  consumeMagicLink,
  createToken,
  consumeToken,
  isAdminWebAuthnEnabled,
  generateRegistrationOptions,
  verifyRegistrationResponse,
  generateAuthenticationOptions,
  verifyAuthenticationResponse,
} from './credentials.js';

// ─── access.ts ────────────────────────────────────────────────────────────────
export type { CaseRole } from './access.js';
export { determineCaseRole } from './access.js';

// ─── csrf.ts ──────────────────────────────────────────────────────────────────
// Note: buildCsrfCookieHeader is already exported from cookies.ts above.
export type { CsrfVerifyInput } from './csrf.js';
export { computeCsrfToken, verifyCsrfToken, issueCsrfToken, verifyCsrf } from './csrf.js';