import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { resolveAuthenticationMode } from '../../domain/resolve-authentication-mode';

/**
 * Emits a prominent boot-time warning when `OAUTH_STRATEGY=none`.
 *
 * This mitigates the footgun introduced by the new `none` default (D3 in design.md):
 * a deployment that relied on the previous `aurora-hub` default would now boot with
 * authentication disabled after upgrading. The warning makes the mode visible in
 * every boot log so operators cannot overlook it.
 *
 * Registered as a provider in `AuthenticationModule` so it runs at module init time.
 */
@Injectable()
export class AuthenticationBootWarning implements OnModuleInit {
  private readonly logger = new Logger(AuthenticationBootWarning.name);

  constructor(private readonly configService: ConfigService) {}

  onModuleInit(): void {
    const mode = resolveAuthenticationMode(this.configService.get<string>('OAUTH_STRATEGY'));

    if (mode === 'none') {
      this.logger.warn(
        '⚠ AUTHENTICATION DISABLED — OAUTH_STRATEGY=none is active. ' +
          'All requests are processed with an anonymous account (no identity, no authority). ' +
          'Endpoints without declared permissions are publicly accessible. ' +
          'Set OAUTH_STRATEGY=aurora-hub or OAUTH_STRATEGY=local-provider to enable authentication.',
      );
    }
  }
}
