import { betterAuth } from 'better-auth'
import { drizzleAdapter } from 'better-auth/adapters/drizzle'
import { admin } from 'better-auth/plugins/admin'
import { tanstackStartCookies } from 'better-auth/tanstack-start'

import { db } from '#/db'
import * as schema from '#/db/schema'

function createAuth() {
  const secret = process.env.BETTER_AUTH_SECRET

  if (!secret) {
    throw new Error('BETTER_AUTH_SECRET environment variable is not set')
  }

  return betterAuth({
    secret,
    database: drizzleAdapter(db, {
      provider: 'pg',
      schema,
    }),
    emailAndPassword: {
      enabled: true,
      // Staff accounts are provisioned via the seed script, not public self sign-up.
      disableSignUp: true,
    },
    session: {
      expiresIn: 60 * 60 * 12,
    },
    // `tanstackStartCookies` must stay last so it sees every other plugin's Set-Cookie headers.
    plugins: [admin(), tanstackStartCookies()],
  })
}

let authInstance: ReturnType<typeof createAuth> | undefined

// Lazily constructed so nothing here runs at module load time — a top-level
// `betterAuth(...)` call would get pulled into the client bundle (and with it
// the Postgres driver) by any route file that imports a sibling export.
export function getAuth() {
  authInstance ??= createAuth()
  return authInstance
}