import type { NextAuthConfig } from "next-auth";
import type { Role } from "@prisma/client";

// Edge-safe Auth.js config: NO database or bcrypt imports here, so it can be
// loaded by the middleware (Edge runtime). The Credentials provider — which
// needs Prisma + bcrypt — is added separately in `auth.ts` (Node runtime only).
export const authConfig = {
  session: { strategy: "jwt" },
  trustHost: true,
  pages: { signIn: "/login" },
  providers: [], // populated in auth.ts
  callbacks: {
    jwt({ token, user }) {
      if (user) {
        token.uid = (user as { id: string }).id;
        token.role = (user as { role: Role }).role;
        token.position = (user as { position: string | null }).position ?? null;
      }
      return token;
    },
    session({ session, token }) {
      if (session.user) {
        session.user.id = token.uid as string;
        session.user.role = token.role as Role;
        session.user.position = (token.position as string | null) ?? null;
      }
      return session;
    },
  },
} satisfies NextAuthConfig;
