import { BNestUserService } from "@bish-nest/admin";
import { BNestAuthService, defaultAuthCallbacks } from "@bish-nest/bnest-auth";
import { BNestPrismaService } from "@bish-nest/prisma";
import { Injectable, OnModuleInit } from "@nestjs/common";
import * as argon from "argon2";

/**
 * RecallAssess supplies only what genuinely differs from the library defaults.
 *
 * RecallAssess is **single-tenant** and has no ACL tables, so:
 *   - the default `assertSignInAllowed` / `assertRefreshAllowed` compose
 *     `isMultiTenantModeEnabled()`, which is false here — the tenant checks
 *     self-disable and the `is_active` guard applies as before;
 *   - `getUserById` uses the library default (`prisma.client.user.findUnique`).
 *
 * ## Why `getUserByEmail` / `validateUser` are still overrides
 *
 * Both resolve through `BNestUserService.findByEmail`, which is more than a
 * lookup: it reads from `baseClient` (so `tenant_id: null` platform
 * super-admins stay visible — irrelevant here, but that is where the logic
 * lives), and it disambiguates the same email appearing in several tenants.
 *
 * That indirection exists to survive multi-tenancy. Once IdentityPilot owns
 * tenancy and the platform operator becomes a JWT fact rather than a
 * `tenant_id: null` row, the tenant-scoped client becomes correct for sign-in
 * and the library's `validateUser` default can take over — these two overrides
 * then disappear.
 *
 * `getUserById` is NOT overridden; the default handles it.
 */
@Injectable()
export class AuthConfigService implements OnModuleInit {
  constructor(
    private authService: BNestAuthService,
    private userService: BNestUserService,
    private prisma: BNestPrismaService,
  ) {}

  onModuleInit() {
    this.authService.setCallbacks(
      defaultAuthCallbacks(
        this.prisma,
        // Unused by RecallAssess (single-tenant → the tenant helpers no-op), but
        // required by the factory signature.
        () => undefined,
        {
          getUserByEmail: async (email: string) => {
            return await this.userService.findByEmail(email);
          },
          validateUser: async (email: string, password: string) => {
            const user = (await this.userService.findByEmail(email)) as Record<string, unknown> | null;
            if (!user) {
              return null;
            }
            const pwMatches = await argon.verify(user["hash"] as string, password);
            return pwMatches ? user : null;
          },
        },
      ),
    );
  }
}