/**
 * `amr` claim values that the BFF treats as evidence of multi-factor
 * authentication having occurred at sign-in (or step-up). Per
 * [ADR-0011](../../../../docs/decisions/0011-mfa-enforcement-entra-conditional-access.md)
 * §"BFF verification" the list is the BFF-side allow-list used by
 * `@RequireMfa()` to decide whether a session is multi-factored.
 *
 * - `mfa`       — generic "multi-factor" indicator Entra emits when a
 *                 Conditional-Access policy enforced MFA, regardless
 *                 of factor.
 * - `otp`       — one-time-password (SMS / authenticator app code).
 * - `fido`      — FIDO2 / WebAuthn (phishing-resistant; the target).
 * - `wia`       — Windows Integrated Auth (Hello, Kerberos-bound).
 * - `phr`       — phishing-resistant authenticator (Entra's umbrella
 *                 token for fido + cert-bound flows).
 *
 * Not exhaustive — the list is reviewed against Microsoft's
 * documentation on each security-review cadence. Adding a value here
 * is a deliberate ADR-recorded decision; do not add ad-hoc.
 *
 * Sign-in via password alone surfaces as `["pwd"]` (no MFA value)
 * and is rejected by `@RequireMfa()` even when the session itself
 * is otherwise valid.
 */
export const MFA_AMR_VALUES = ['mfa', 'otp', 'fido', 'wia', 'phr'] as const;

/**
 * True when at least one entry in the session user's `amr` array is
 * in {@link MFA_AMR_VALUES}. Used by `RequireMfaGuard` and by the
 * (deferred) callback-time sanity-check per ADR-0011 §"Confirmation".
 */
export function wasMultiFactor(amr: readonly string[]): boolean {
  const allowed = new Set<string>(MFA_AMR_VALUES);
  return amr.some((v) => allowed.has(v));
}
