import { Module } from '@nestjs/common';
import { PassportModule } from '@nestjs/passport';
import { HUB_SESSION_MANAGER, JWT_SIGNER, ACCOUNT_LOADER } from './domain/ports';
import { authenticationStrategyProvider } from './infrastructure/factory/authentication-strategy.factory';
import { hubSessionManagerProvider } from './infrastructure/providers/hub-session-manager.provider';
import { jwtSignerProvider } from './infrastructure/providers/jwt-signer.provider';
import { AuroraHubConsumerAdapter } from './infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter';
import { JwtPassportStrategy } from './infrastructure/strategies/jwt-passport.strategy';
import { JwtSignerAdapter } from './infrastructure/strategies/local-provider/jwt-signer.adapter';
import { LocalProviderAdapter } from './infrastructure/strategies/local-provider/local-provider.adapter';
import { AuthenticationBootWarning } from './infrastructure/warnings/authentication-boot-warning';
import { AnonymousAccountLoaderAdapter } from './infrastructure/strategies/local-provider/anonymous-account-loader.adapter';

/**
 * Leaf module: depends ONLY on `@nestjs/passport` + the cross-BC port tokens exposed by
 * the @Global() `BridgesModule`. Must NOT import application-level modules (`OAuthModule`,
 * `IamModule`, etc.) — doing so creates a circular dependency through `@aurora/decorators`,
 * which is imported by every `@Auth()`-decorated controller in the app.
 *
 * The `TokenRetentionService` (which needs OAuth repositories) lives at
 * `@app/o-auth/shared/services/token-retention.service` and is registered in `OAuthModule`,
 * not here, for the same reason.
 *
 * `AuthenticationBootWarning` emits a prominent log on `onModuleInit` when
 * `OAUTH_STRATEGY=none` is active, mitigating the footgun of the new default.
 *
 * Two tokens cross the module boundary:
 *   - `JWT_SIGNER` — consumed by token-issuance services (password/refresh/authorization-code).
 *   - `HUB_SESSION_MANAGER` — consumed by `OAuthHubSessionService` (cookie sign/verify) and
 *     indirectly by controllers that read the hub_session cookie.
 */
@Module({
  imports: [PassportModule.register({ defaultStrategy: 'jwt' })],
  providers: [
    AuroraHubConsumerAdapter,
    LocalProviderAdapter,
    JwtSignerAdapter,
    jwtSignerProvider,
    hubSessionManagerProvider,
    authenticationStrategyProvider,
    JwtPassportStrategy,
    AuthenticationBootWarning,
      AnonymousAccountLoaderAdapter,
      { provide: ACCOUNT_LOADER, useExisting: AnonymousAccountLoaderAdapter }
],
  exports: [JWT_SIGNER, HUB_SESSION_MANAGER],
})
export class AuthenticationModule {}
