// NextAuth v5 bootstrap for gscMy via @gsc/web-kit.
//
// Identity is sourced entirely from Keycloak — FreeIPA owns user
// management, Keycloak federates and authenticates, group membership
// → realm roles → permissions. No local users table writes from
// login. See gsc-identity-boundaries memory + docs/pam-plan.md.
//
// gscMy is the tenant user portal — including the place where users
// request privileged access via the PAM/JIT flow. We intentionally
// do NOT gate signin on a specific role: anyone who can authenticate
// against gosecCloud belongs here.

import { createAuth } from "@gsc/web-kit/auth/server";

export const { handlers, signIn, signOut, auth, requireAuth } = createAuth({
  keycloak: {
    clientId: process.env.AUTH_KEYCLOAK_ID!,
    clientSecret: process.env.AUTH_KEYCLOAK_SECRET!,
    issuer: process.env.AUTH_KEYCLOAK_ISSUER!,
  },
  pages: {
    signIn: "/auth/keycloak",
    error: "/access-denied",
  },
});

// Re-export SessionUser for app code that imports the type.
export type { SessionUser } from "@gsc/web-kit/auth";

// Compatibility helper for legacy callers that used the async
// getAuthenticatedUser() pattern. Kit's `auth()` already returns
// session.user — this just unwraps it for those call sites.
export async function getAuthenticatedUser() {
  const session = await auth();
  return session?.user ?? null;
}
