/**
 * Builds the `socialProviders` config object for betterAuth().
 *
 * Only includes a provider when ALL of its required env vars are present
 * (non-empty strings). This lets the app start without Google/Apple
 * credentials and enables providers incrementally via env vars.
 */

type Env = Record<string, string | undefined>;

export interface SocialProviderConfig {
	google?: {
		clientId: string;
		clientSecret: string;
	};
	apple?: {
		clientId: string;
		clientSecret: string;
		appBundleIdentifier?: string;
	};
}

export function buildSocialProviders(env: Env): SocialProviderConfig {
	const providers: SocialProviderConfig = {};

	// Google — needs clientId + clientSecret
	if (env.AUTH_GOOGLE_CLIENT_ID && env.AUTH_GOOGLE_CLIENT_SECRET) {
		providers.google = {
			clientId: env.AUTH_GOOGLE_CLIENT_ID,
			clientSecret: env.AUTH_GOOGLE_CLIENT_SECRET,
		};
	}

	// Apple — needs clientId, clientSecret (pre-generated JWT), teamId, keyId,
	// and privateKey. If the caller has already generated the JWT client secret
	// and stored it in AUTH_APPLE_CLIENT_SECRET, all five vars must be present.
	if (
		env.AUTH_APPLE_CLIENT_ID &&
		env.AUTH_APPLE_CLIENT_SECRET &&
		env.AUTH_APPLE_TEAM_ID &&
		env.AUTH_APPLE_KEY_ID &&
		env.AUTH_APPLE_PRIVATE_KEY
	) {
		providers.apple = {
			clientId: env.AUTH_APPLE_CLIENT_ID,
			clientSecret: env.AUTH_APPLE_CLIENT_SECRET,
		};
	}

	return providers;
}
