import { InjectionToken } from '@angular/core';

/**
 * BFF API base URL the AuthService prepends to every backend call
 * (`${base}/auth/me`, `${base}/auth/login`, …). Provided by the host
 * application from its per-environment config (`environment.ts`,
 * per ADR-0018) so the lib stays decoupled from the app's
 * environment file shape.
 *
 * Wiring lives in the host's `ApplicationConfig`:
 *
 *   { provide: AUTH_BFF_BASE_URL, useValue: environment.bffApiBaseUrl }
 */
export const AUTH_BFF_BASE_URL = new InjectionToken<string>('AUTH_BFF_BASE_URL');

/**
 * Indirection over `window.location.assign(...)` used by `login()`
 * and `logout()`. Injecting the navigator lets specs assert the
 * outbound URL without having to redefine `window.location` (which
 * jsdom resists across multiple tests in the same file).
 *
 * The default implementation in `provideAuth()` calls
 * `window.location.assign(url)`. Tests can override with a `vi.fn()`.
 */
export const AUTH_NAVIGATOR = new InjectionToken<(url: string) => void>('AUTH_NAVIGATOR', {
  providedIn: 'root',
  factory: () => (url: string) => window.location.assign(url),
});

/**
 * Name of the BFF's CSRF cookie that the `csrfInterceptor` reads
 * to echo back in the `X-CSRF-Token` header. Provided by the host
 * from its per-environment config (`environment.bffCsrfCookieName`)
 * so the lib doesn't have to know the env-conditional naming
 * (`portal_csrf` dev / `__Host-portal_csrf` prod) the BFF picks.
 */
export const AUTH_CSRF_COOKIE_NAME = new InjectionToken<string>('AUTH_CSRF_COOKIE_NAME');

/**
 * Path prefix the BFF mounts the OIDC routes under. Joined to
 * `AUTH_BFF_BASE_URL` to build the full URLs for `/me`, `/login`,
 * `/logout`. `portal-shell` provides `/auth` (per ADR-0009);
 * `portal-admin` provides `/admin/auth` (per ADR-0020 §"Sessions —
 * distinct from `portal-shell`"). The lib stays surface-agnostic;
 * the host picks which BFF auth surface its session belongs to.
 *
 * Default is `/auth` so portal-shell-shaped consumers can omit the
 * provider and still work — matches the original (pre-admin) lib
 * shape. Hosts on the admin surface MUST override.
 */
export const AUTH_PATH_PREFIX = new InjectionToken<string>('AUTH_PATH_PREFIX', {
  providedIn: 'root',
  factory: () => '/auth',
});
