/// <reference path="../pb_data/types.d.ts" />
//
// Shared helpers for pb_hooks/*.pb.js callbacks.
//
// PocketBase's JSVM serializes and runs each registered hook callback as its
// own isolated program, so a plain top-level function declared in a *.pb.js
// file is NOT in scope inside a callback at call time. Reusable helpers must
// instead live in a plain (non *.pb.js, so it isn't auto-loaded as a hook)
// module and be pulled in per-callback via require(`${__hooks}/utils.js`).
// See: https://github.com/pocketbase/pocketbase/discussions/3599
//
// Loaded modules use a shared registry across callback invocations, so keep
// this file stateless.
//
// Keep resolveRole in sync with src/lib/azureAuth.js's resolveRole (the
// canonical, unit-tested version used by the frontend).

module.exports = {
  /**
   * Resolve a user's role from their e-mail and the ENTRA_ADMIN_EMAILS allow-list.
   * @param {string} email
   * @returns {"admin"|"user"}
   */
  resolveRole: function (email) {
    const raw = ($os.getenv("ENTRA_ADMIN_EMAILS") || "").toLowerCase();
    const allow = raw.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
    return allow.indexOf(String(email || "").toLowerCase()) !== -1 ? "admin" : "user";
  },
};