/**
 * Operator-facing diagnostic for auth-service authentication failures.
 *
 * Pre-fix, an empty OLAM_AUTH_SECRET (compose.yaml's
 * `${OLAM_AUTH_SECRET:-}` interpolation when the operator's shell
 * didn't export it) silently 401'd every host-cp → auth-service
 * call. The SPA showed "0 credentials" with no log line explaining
 * why. Logging a clear hint — both at boot when the env var is empty
 * AND on the first runtime 401 — turns a silent footgun into a
 * grep-able warning.
 *
 * Lives in its own file (not server.mjs) so unit tests can import it
 * without triggering server.mjs's top-level mkdir + http.listen side
 * effects.
 */

/**
 * @param {object} ctx
 * @param {string} ctx.authServiceUrl
 *   The configured auth-service base URL — quoted back to the operator
 *   so they can cross-reference with their compose env.
 * @param {boolean} ctx.hasSecret
 *   True when host-cp's OLAM_AUTH_SECRET is set (and the 401 means a
 *   value mismatch); false when it's empty (the original silent-fail
 *   regression mode).
 * @returns {string}
 *   A single-line message safe for `console.warn` / docker-compose-logs.
 */
export function authSecretHint({ authServiceUrl, hasSecret }) {
  if (!hasSecret) {
    return (
      `[auth] auth-service at ${authServiceUrl} is configured but ` +
      `OLAM_AUTH_SECRET is empty — every credentials/* call will 401. ` +
      `Set the env var to the contents of ~/.olam/auth-secret (or run ` +
      `'olam host-cp start' so the CLI loads it for you).`
    );
  }
  return (
    `[auth] auth-service at ${authServiceUrl} returned 401 even though ` +
    `OLAM_AUTH_SECRET is set — the secret does NOT match the value the ` +
    `auth-service container is using. Check that both containers were ` +
    `started from the same ~/.olam/auth-secret file and recreate them ` +
    `together if the file changed.`
  );
}
