/**
 * Composition root for the auth service — the only file that wires concrete
 * DB-backed adapters into the domain services. Mirrors
 * `services/expense/loader.ts`'s pattern.
 */
import { db } from '../expense/db/client.js'
import { AuthRepository } from './auth.repository.js'
import { MembershipRepository } from './tenant-membership/tenant-membership.repository.js'
import { TenantMembershipService } from './tenant-membership/tenant-membership.service.js'
import { TokenSigner } from './token-signer.js'
import { AuthService } from './auth.service.js'

function loadPrivateKey(): string {
  const key = process.env['JWT_PRIVATE_KEY']
  if (!key) throw new Error('JWT_PRIVATE_KEY is not set')
  // Support the common env-var convention of escaping newlines as literal `\n`.
  return key.includes('\\n') ? key.replace(/\\n/g, '\n') : key
}

const authRepo = new AuthRepository(db)
const membershipRepo = new MembershipRepository(db)
const membershipService = new TenantMembershipService(membershipRepo)
const tokenSigner = new TokenSigner(loadPrivateKey)
const authService = new AuthService(authRepo, membershipService, tokenSigner)

export const authContainer = {
  authService,
  membershipService,
  tokenSigner,
} as const

export type AuthContainer = typeof authContainer