import { signal, Signal } from '@angular/core';

/**
 * The portal's view of the signed-in user. An abstraction over the OIDC library so components and
 * guards depend on a small, mockable surface (the real implementations are DigiadAuthService for
 * citizens and MedewerkerAuthService for staff).
 */
export abstract class AuthService {
  /** Whether a session is active. */
  abstract readonly isAuthenticated: Signal<boolean>;
  /** The citizen-service number from the DigiD token, once authenticated (staff have none). */
  abstract readonly bsn: Signal<string | undefined>;
  /**
   * The realm roles carried in the token. Empty for realms that don't grant roles (e.g. `digid`);
   * the `medewerker` realm carries `behandelaar`/`teamlead`.
   */
  readonly roles: Signal<readonly string[]> = signal<readonly string[]>([]);
  /** Start login (redirects to Keycloak). */
  abstract login(): void;
  /** End the session. */
  abstract logout(): void;
  /** Whether the signed-in user holds the given realm role. */
  hasRole(role: string): boolean {
    return this.roles().includes(role);
  }
}