import type { NextAuthConfig } from "next-auth";

export function buildAuthConfig(authUrl?: string | null): NextAuthConfig {
  const resolvedAuthUrl = authUrl || process.env.AUTH_URL || "";
  const isSecure = resolvedAuthUrl.startsWith("https://");
  // Use host-only cookies to avoid cross-domain login issues in multi-domain deployments.
  const cookieDomain = undefined;

  // trustHost 仅在明确配置时开启，避免 host header 注入攻击
  // 部署在 Vercel 或受信反向代理后时，设置 AUTH_TRUST_HOST=true
  const trustHost =
    process.env.AUTH_TRUST_HOST === "true" ||
    process.env.VERCEL === "1";

  return {
    trustHost,
    pages: {
      signIn: "/login",
      newUser: "/",
    },
    cookies: {
      sessionToken: {
        name: isSecure ? "__Secure-authjs.session-token" : "authjs.session-token",
        options: {
          httpOnly: true,
          sameSite: "lax",
          path: "/",
          secure: isSecure,
          domain: cookieDomain,
        },
      },
      callbackUrl: {
        name: isSecure ? "__Secure-authjs.callback-url" : "authjs.callback-url",
        options: {
          sameSite: "lax",
          path: "/",
          secure: isSecure,
          domain: cookieDomain,
        },
      },
      csrfToken: {
        name: isSecure ? "__Host-authjs.csrf-token" : "authjs.csrf-token",
        options: {
          httpOnly: true,
          sameSite: "lax",
          path: "/",
          secure: isSecure,
        },
      },
    },
    providers: [],
    callbacks: {},
  };
}