/// <reference path="../pb_data/types.d.ts" />
//
// Issue #18 — Reconcile the Entra (Azure) OIDC provider from the environment.
//
// The team_members→auth migration (pb_migrations/1781000000) is structure-only
// and runs exactly once. Provider CONFIGURATION lives here instead, so that:
//
//   * an environment whose migration applied while the ENTRA_* secrets were
//     absent gets its provider enabled on the next startup (no re-apply),
//   * rotating ENTRA_CLIENT_SECRET / changing the tenant only requires new env
//     values and a container restart,
//   * a fresh database gets its provider on the first cron tick right after
//     the migrations created the collection (onBootstrap fires BEFORE the
//     migrations run — there is no post-migration lifecycle hook in the JSVM,
//     hence the cron fallback).
//
// The reconciler compares before saving, so both hooks are cheap no-ops when
// everything is already in sync.

onBootstrap((e) => {
  e.next();
  const { reconcileEntraOidc } = require(`${__hooks}/utils.js`);
  // reconcileEntraOidc logs a warn-once itself when the ENTRA_* env is absent.
  console.log("entra_oidc reconcile (bootstrap): " + reconcileEntraOidc(e.app));
});

cronAdd("entraOidcReconcile", "* * * * *", () => {
  const { reconcileEntraOidc } = require(`${__hooks}/utils.js`);
  const result = reconcileEntraOidc($app);
  // Only log state changes — this tick runs every minute.
  if (result === "updated") {
    console.log("entra_oidc reconcile (cron): OIDC provider (re)configured from ENTRA_* env");
  }
});