import type { AuthenticatedAccount } from './ports/account-loader.port';

/**
 * Factory that returns a fresh anonymous `AuthenticatedAccount` per request.
 *
 * Used by `AuthenticationJwtGuard` when `OAUTH_STRATEGY=none` to short-circuit
 * passport: the guard injects this account into `request.user` and returns `true`
 * without invoking passport.
 *
 * Key invariants:
 * - `dPermissions.all = []`  → `AuthorizationPermissionsGuard` lets through endpoints
 *   with no declared permissions and rejects `@Auth('<permission>')` endpoints with 403.
 *   "No authentication → no identity → no authority."
 * - Returns a **fresh object per call** (not a frozen shared constant) to prevent
 *   request-scoped interceptors from accidentally mutating shared state across requests.
 */
export function createAnonymousAccount(): AuthenticatedAccount {
  return {
    id: 'anonymous',
    clientId: null,
    email: null,
    username: 'anonymous',
    isActive: true,
    scopes: [],
    dApplicationCodes: [],
    dPermissions: { all: [] },
    dTenants: [],
    meta: null,
    roles: [],
    tenants: [],
    user: null,
    createdAt: null,
    updatedAt: null,
    deletedAt: null,
  };
}
