import {
  createAuth,
  getSession,
  requireRole,
  type AuthEngine,
  type Principal,
  type SignInCredentials,
} from '@platform-modules/auth'

export const COOKIE_NAME = '__Host-pdf2html_access'
export const ROLE_HIERARCHY = ['user', 'admin'] as const

export function composeServerAuth(engine: AuthEngine) {
  const auth = createAuth(engine)

  return {
    signIn(credentials: SignInCredentials) {
      return auth.signIn(credentials)
    },
    getPrincipal(headers: HeadersInit) {
      return getSession(headers, engine, { accessCookieName: COOKIE_NAME })
    },
    requireAdmin(principal: Principal | null) {
      return requireRole('admin', ROLE_HIERARCHY)(principal)
    },
    refresh(refreshToken: string) {
      return auth.refresh(refreshToken)
    },
    signOut(sessionId: string, refreshToken?: string) {
      return auth.signOut(sessionId, refreshToken)
    },
  }
}

export type { AuthEngine, Principal, SignInCredentials }