// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
// What the app server asks of this deployment (@conusai-kit/auth-convex-better-auth):
//
//   validateSession      the session check of every request, under the token Better Auth issued for
//                        the request's own session cookie (public: a token is the only way in)
//   pendingRevocations   the revocation outbox, drained by the relay with the deployment's admin key
//   settleRevocation     (internal: only the admin key reaches them)
//   endAccount           the app's own account deletion ends the person's Better Auth account first
//                        (internal), through Better Auth itself, so the component triggers record it
import { defineBetterAuthSessionApi } from "@conusai-kit/auth-convex-better-auth/convex"
import { v } from "convex/values"
import { components } from "./_generated/api"
import { internalMutation } from "./_generated/server"
import { authComponent, createAuth } from "./auth"

export const { validateSession, pendingRevocations, settleRevocation } = defineBetterAuthSessionApi({
  authComponent,
  component: components.betterAuth,
})

export const endAccount = internalMutation({
  args: { userId: v.string() },
  returns: v.null(),
  handler: async (ctx, { userId }) => {
    const auth = await createAuth(ctx).$context
    if (!(await auth.internalAdapter.findUserById(userId))) return null
    // Its sessions, accounts and the user, each through the component, so every trigger records it.
    await auth.internalAdapter.deleteUser(userId)
    return null
  },
})