import { prisma } from '@ketopath/db';
import { betterAuth } from 'better-auth';
import { prismaAdapter } from 'better-auth/adapters/prisma';

import { readAuthEnv } from './env.js';

const env = readAuthEnv();

const googleProvider =
  env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET
    ? {
        google: {
          clientId: env.GOOGLE_CLIENT_ID,
          clientSecret: env.GOOGLE_CLIENT_SECRET,
        },
      }
    : undefined;

export const auth = betterAuth({
  database: prismaAdapter(prisma, { provider: 'postgresql' }),
  secret: env.BETTER_AUTH_SECRET,
  baseURL: env.BETTER_AUTH_URL,
  emailAndPassword: {
    enabled: true,
    // MVP: nessuna verifica email per non bloccare l'onboarding (vedi
    // docs/decisions/0001-auth-provider.md). Verrà attivata in V1.
    requireEmailVerification: false,
    minPasswordLength: 8,
  },
  socialProviders: googleProvider,
  session: {
    expiresIn: 60 * 60 * 24 * 7, // 7 giorni
    updateAge: 60 * 60 * 24, // refresh expiresAt ogni 24h se la session è attiva
  },
  advanced: {
    cookiePrefix: 'ketopath',
  },
});

export type Auth = typeof auth;