/**
 * Bridge between auth providers and NeuroLink's server middleware.
 * Converts an auth provider's authenticateToken() into the validate
 * callback expected by the existing createAuthMiddleware.
 */
/**
 * Create a validate function for server auth middleware from an auth provider.
 */
export function createAuthValidatorFromProvider(provider) {
    return async (token, ctx) => {
        const result = await provider.authenticateToken(token, ctx);
        if (!result.valid) {
            return null;
        }
        if (result.user) {
            return {
                id: result.user.id,
                email: result.user.email,
                roles: result.user.roles,
            };
        }
        // Fail closed: valid token without a resolved user is treated as failure
        return null;
    };
}
