/**
 * community blueprint · wiring seam for `@platform-modules/auth`.
 *
 * Adapter-minimalism (CLAUDE.md §4): instantiate auth's real exports with an in-memory engine.
 * Unlike saas-admin — where capabilities are tenant-scoped through `@platform-modules/tenancy` — a
 * community site is SINGLE-SCOPE: the Principal carries its capabilities directly and
 * requirePermission gates on them with no tenancy layer in between. A real host injects a JWT/DB-
 * backed AuthEngine; this proves only the seam (verifySession resolves a bearer token → Principal).
 *
 * NOTE (delivery-stack §7 convergence signal): this fake is structurally identical to
 * saas-admin/wiring/auth.ts — two blueprints converging on the same auth seam is exactly the
 * evidence a generator is earned. The ONLY difference is where capabilities come from (session here,
 * tenancy there), which is the host's wiring choice, not a different contract.
 */
import type { AuthEngine, Principal } from '@platform-modules/auth'

/** Thrown by engine methods this worked example deliberately does not exercise. */
function outsideBlueprint(method: string): never {
  throw new Error(`auth.${method}() is outside the community blueprint flow (only verifySession is exercised)`)
}

/**
 * Fake engine over an in-memory token→Principal map. verifySession is fully implemented (the seam the
 * publish flow uses); the remaining AuthEngine methods are explicitly out of scope and throw a clear
 * error rather than silently no-op — a real host supplies a full engine.
 */
export function createFakeAuthEngine(sessionsByToken: Map<string, Principal>): AuthEngine {
  return {
    async verifySession(token: string): Promise<Principal | null> {
      return sessionsByToken.get(token) ?? null
    },
    async signIn() {
      return outsideBlueprint('signIn')
    },
    async signOut() {
      return outsideBlueprint('signOut')
    },
    async refresh() {
      return outsideBlueprint('refresh')
    },
    async createUser() {
      return outsideBlueprint('createUser')
    },
    async setPassword() {
      return outsideBlueprint('setPassword')
    },
    async verifyPassword() {
      return outsideBlueprint('verifyPassword')
    },
  }
}

/** Build an `Authorization: Bearer <token>` header — the shape getSession reads. */
export function bearer(token: string): Headers {
  return new Headers({ authorization: `Bearer ${token}` })
}