import { useSession } from "@tanstack/react-start/server"
import {
	DEFAULT_SESSION_MAX_AGE,
	DEFAULT_SESSION_NAME,
	SESSION_SECRET_MIN_LENGTH,
	type SessionData,
} from "@wp-reactor/auth"

// I/O de la session scellée — server-only, vit dans la COQUE (Option B, ADR 0001).
// Le package @wp-reactor/auth fournit le contrat (SessionData) + les constantes.

function getSessionSecret(): string {
	const secret = process.env.SESSION_SECRET
	if (!secret || secret.length < SESSION_SECRET_MIN_LENGTH) {
		throw new Error(
			"[auth] SESSION_SECRET must be set (>= 32 chars). Generate one with `openssl rand -base64 48`.",
		)
	}
	return secret
}

export function useAppSession() {
	return useSession<SessionData>({
		password: getSessionSecret(),
		name: DEFAULT_SESSION_NAME,
		maxAge: DEFAULT_SESSION_MAX_AGE,
		cookie: {
			httpOnly: true,
			secure: process.env.NODE_ENV === "production",
			sameSite: "lax",
			path: "/",
		},
	})
}