/// <reference path="../pb_data/types.d.ts" />
//
// Issue #16 — Auto-provisioning & role assignment for Azure (Entra ID) users.
//
// PocketBase auto-creates a `team_members` auth record on the first OIDC login
// (name is filled from the OIDC `name` claim via the collection's mappedFields).
// These hooks add the application-specific bits:
//
//   * default `role` from an admin allow-list (env ENTRA_ADMIN_EMAILS),
//   * default `enrollment_status = "not_started"` so new users go through the
//     existing onboarding screen,
//   * re-sync the admin role on every login so allow-list changes take effect
//     without manual edits.
//
// The allow-list is a comma-separated list of e-mail addresses, e.g.:
//   ENTRA_ADMIN_EMAILS=rve@respellion.nl,admin@respellion.nl
//
// Keep this logic in sync with src/lib/azureAuth.js (resolveRole / parseAdminEmails),
// which carries the canonical, unit-tested version for the frontend/tests.
//
// resolveRole itself lives in pb_hooks/utils.js and is pulled in per-callback
// via require() — PocketBase's JSVM runs each hook callback below as its own
// isolated program, so a shared top-level function here would not be in
// scope at call time. See pb_hooks/utils.js for details.

// On creation (first login): set defaults before the record is persisted.
onRecordCreate(function (e) {
  const { resolveRole } = require(`${__hooks}/utils.js`);
  const email = e.record.get("email") || "";

  e.record.set("role", resolveRole(email));

  if (!e.record.get("enrollment_status")) {
    e.record.set("enrollment_status", "not_started");
  }

  // Fallback name when the IdP supplied no `name` claim.
  if (!e.record.get("name")) {
    e.record.set("name", email ? email.split("@")[0] : "Onbekend");
  }

  e.next();
}, "team_members");

// On every successful auth (incl. OIDC): keep the admin role in sync with the
// allow-list, so promoting/demoting an admin only requires an env change.
onRecordAuthRequest(function (e) {
  const { resolveRole } = require(`${__hooks}/utils.js`);
  const email = e.record.get("email") || "";
  const want = resolveRole(email);
  if (e.record.get("role") !== want) {
    e.record.set("role", want);
    e.app.save(e.record);
  }
  e.next();
}, "team_members");