/**
 * saas-admin blueprint · wiring seam for `@platform-modules/auth`.
 *
 * Adapter-minimalism (CLAUDE.md §4): this file ONLY instantiates auth's real exports with a
 * consumer-side fake engine. A real host injects a JWT/DB-backed AuthEngine; the blueprint proves
 * the SEAM — getSession reads a bearer/cookie token, the engine resolves it to a Principal, and
 * requirePermission gates on that Principal's capabilities. Nothing here is product logic.
 */
import type { AuthEngine, Principal } from '@platform-modules/auth'

/** Thrown by engine methods this worked example deliberately does not exercise. */
function outsideBlueprint(method: string): never {
  throw new Error(`auth.${method}() is outside the saas-admin blueprint flow (only verifySession is exercised)`)
}

/**
 * Fake engine over an in-memory token→Principal map. verifySession is fully implemented (it is the
 * seam the admin flow uses); the remaining AuthEngine methods are explicitly out of scope for THIS
 * blueprint and throw a clear error rather than silently no-op — a real host supplies a full engine.
 */
export function createFakeAuthEngine(sessionsByToken: Map<string, Principal>): AuthEngine {
  return {
    async verifySession(token: string): Promise<Principal | null> {
      return sessionsByToken.get(token) ?? null
    },
    async signIn() {
      return outsideBlueprint('signIn')
    },
    async signOut() {
      return outsideBlueprint('signOut')
    },
    async refresh() {
      return outsideBlueprint('refresh')
    },
    async createUser() {
      return outsideBlueprint('createUser')
    },
    async setPassword() {
      return outsideBlueprint('setPassword')
    },
    async verifyPassword() {
      return outsideBlueprint('verifyPassword')
    },
  }
}

/** Build a `Authorization: Bearer <token>` header — the shape getSession reads. */
export function bearer(token: string): Headers {
  return new Headers({ authorization: `Bearer ${token}` })
}