import type { NextAuthConfig } from "next-auth";
import { isIP } from "node:net";

export function buildAuthConfig(authUrl?: string | null): NextAuthConfig {
  const resolvedAuthUrl = authUrl || process.env.AUTH_URL || "";
  const isSecure = resolvedAuthUrl.startsWith("https://");
  const hostName = resolvedAuthUrl ? new URL(resolvedAuthUrl).hostname : undefined;
  // Browsers may reject `Domain` cookies for IP hosts; keep them host-only in that case.
  const cookieDomain =
    hostName && hostName !== "localhost" && isIP(hostName) === 0 ? hostName : undefined;

  return {
    trustHost: true,
    pages: {
      signIn: "/login",
      newUser: "/",
    },
    cookies: {
      sessionToken: {
        name: isSecure ? "__Secure-authjs.session-token" : "authjs.session-token",
        options: {
          httpOnly: true,
          sameSite: "lax",
          path: "/",
          secure: isSecure,
          domain: cookieDomain,
        },
      },
      callbackUrl: {
        name: isSecure ? "__Secure-authjs.callback-url" : "authjs.callback-url",
        options: {
          sameSite: "lax",
          path: "/",
          secure: isSecure,
          domain: cookieDomain,
        },
      },
      csrfToken: {
        name: isSecure ? "__Host-authjs.csrf-token" : "authjs.csrf-token",
        options: {
          httpOnly: true,
          sameSite: "lax",
          path: "/",
          secure: isSecure,
        },
      },
    },
    providers: [],
    callbacks: {},
  };
}