/**
 * Returns the ordered list of available sign-in providers based on which
 * environment variables are configured.
 *
 * Used by the sign-in page to render provider buttons.
 *
 * signInMethod:
 *   - "social"  → call signIn.social({ provider: id, callbackURL })
 *   - "oauth2"  → call signIn.oauth2({ providerId: id, callbackURL })
 */

type Env = Record<string, string | undefined>;

export interface SignInProvider {
	id: string;
	label: string;
	signInMethod: "social" | "oauth2";
}

export function getSignInProviders(env: Env): SignInProvider[] {
	const providers: SignInProvider[] = [];

	// Authentik (genericOAuth)
	if (
		env.AUTH_AUTHENTIK_CLIENT_ID &&
		env.AUTH_AUTHENTIK_CLIENT_SECRET &&
		env.AUTH_AUTHENTIK_ISSUER
	) {
		providers.push({
			id: "authentik",
			label: "Authentik",
			signInMethod: "oauth2",
		});
	}

	// Google (socialProviders)
	if (env.AUTH_GOOGLE_CLIENT_ID && env.AUTH_GOOGLE_CLIENT_SECRET) {
		providers.push({
			id: "google",
			label: "Google",
			signInMethod: "social",
		});
	}

	// Apple (socialProviders) — all five vars required
	if (
		env.AUTH_APPLE_CLIENT_ID &&
		env.AUTH_APPLE_CLIENT_SECRET &&
		env.AUTH_APPLE_TEAM_ID &&
		env.AUTH_APPLE_KEY_ID &&
		env.AUTH_APPLE_PRIVATE_KEY
	) {
		providers.push({
			id: "apple",
			label: "Apple",
			signInMethod: "social",
		});
	}

	return providers;
}
