// Composition root. Every port the framework knows wires here; routes and
// helpers read ports from the resulting `RaredaysApp` instance.
//
// Default uses the in-memory IdentityProvider so `pnpm dev` runs out of the
// box. To go to production:
//   1. Install `@raredays/identity-better-auth`, configure Better Auth
//      against your Drizzle database.
//   2. Replace `createInMemoryProvider(...)` below with
//      `createBetterAuthProvider({ auth, idStrategy: siteSpec.idStrategy })`,
//      reading `idStrategy` from `site.spec.ts` (framework ADR-0028).
//   3. Mount Better Auth's handler at `app/api/auth/[...all]/route.ts`.

import { createInMemoryPermissionProvider, createRaredaysApp, Session, User } from "@raredays/core";
import { createInMemoryProvider } from "@raredays/identity/testing";
// CRDA:imports

// — Authorization (what each role can do) ─────────────────────────────────
// Checks ask the permission port (framework ADR-0025), as app/protected/page.tsx
// does. The in-memory adapter suits dev and tests; production swaps in the
// identity provider's adapter.
const permissionProvider = createInMemoryPermissionProvider({
  rolePermissions: {
    member: ["content.read"],
    admin: ["content.read", "content.manage"],
  },
});

// — Seeded dev user (replace with Better Auth in production) ──────────────
const ALICE = User.from({
  id: "u_alice",
  email: "alice@example.com",
  organizationId: "default",
  roles: ["member"],
  emailVerifiedAt: new Date("2026-01-01T00:00:00Z"),
});

const ALICE_SESSION = Session.from({
  id: "s_alice",
  userId: ALICE.id,
  user: ALICE.toJSON(),
  expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24),
});

const identityProvider = createInMemoryProvider({
  users: [ALICE],
  sessions: [ALICE_SESSION],
});

export const SEEDED = { user: ALICE, sessionId: ALICE_SESSION.id };

// CRDA:config

export const app = createRaredaysApp({
  identityProvider,
  permissionProvider,
  // CRDA:ports
});

// CRDA:exports