import { SvelteKitAuth } from '@auth/sveltekit';
import { env } from '$env/dynamic/private';

export const { handle, signIn, signOut } = SvelteKitAuth({
	providers: [
		{
			id: 'synology',
			name: 'Synology',
			type: 'oidc',
			issuer: env.SYNOLOGY_ISSUER,
			clientId: env.SYNOLOGY_CLIENT_ID,
			clientSecret: env.SYNOLOGY_CLIENT_SECRET,
			redirectProxyUrl: env.AUTH_URL,
			profile(profile) {
				return {
					id: profile.sub as string,
					name: (profile.username ?? profile.name ?? profile.preferred_username) as string,
					email: profile.email as string | undefined
				};
			}
		}
	],
	trustHost: true,
	callbacks: {
		jwt({ token, profile }) {
			if (profile?.sub) token.sub = profile.sub as string;
			return token;
		},
		session({ session, token }) {
			if (token.sub) session.user.id = token.sub;
			return session;
		},
		redirect({ url, baseUrl }) {
			const appRoot = env.AUTH_URL?.replace(/\/auth$/, '') ?? baseUrl;
			if (url.startsWith(appRoot)) return url;
			return appRoot;
		}
	},
	cookies: {
		sessionToken: { name: 'authjs.session-token' },
		callbackUrl: { name: 'authjs.callback-url' },
		csrfToken: { name: 'authjs.csrf-token' }
	}
});