import { env } from '$env/dynamic/private';
import { betterAuth } from 'better-auth/minimal';
import { drizzleAdapter } from 'better-auth/adapters/drizzle';
import { sveltekitCookies } from 'better-auth/svelte-kit';
import { getRequestEvent } from '$app/server';
import { db } from '$lib/server/db';
import * as schema from '$lib/server/db/schema';
import type { RequestEvent } from '@sveltejs/kit';

export const auth = betterAuth({
	baseURL: env.ORIGIN ?? 'http://localhost:3000',
	secret: env.BETTER_AUTH_SECRET ?? 'build-time-placeholder',
	database: drizzleAdapter(db, { provider: 'pg', schema }),
	emailAndPassword: { enabled: true },
	socialProviders: {
		github: {
			clientId: env.GITHUB_CLIENT_ID,
			clientSecret: env.GITHUB_CLIENT_SECRET
		}
	},
	plugins: [
		sveltekitCookies(getRequestEvent) // make sure this is the last plugin in the array
	]
});

export function isAdmin(event: RequestEvent): boolean {
	const token = event.cookies.get('admin_token');
	return !!token && token === env.ADMIN_SECRET;
}

export function requireAdmin(event: RequestEvent): void {
	if (!isAdmin(event)) {
		throw new Response(JSON.stringify({ error: 'Unauthorized' }), {
			status: 401,
			headers: { 'Content-Type': 'application/json' }
		});
	}
}