import type { BetterAuthPlugin } from "better-auth";
import { captcha, emailOTP, genericOAuth, haveIBeenPwned, openAPI } from "better-auth/plugins";
import { buildAuthEmail, sendEmail } from "./email";
import type { Env } from "./env";
import { createGenericOAuthProviders } from "./oauth";

export function createAuthPlugins(env: Env): BetterAuthPlugin[] {
  const plugins: BetterAuthPlugin[] = [
    openAPI(),
    haveIBeenPwned({
      customPasswordCompromisedMessage: "This password has appeared in a data breach.",
    }),
    emailOTP({
      otpLength: 6,
      expiresIn: 300,
      allowedAttempts: 3,
      storeOTP: "hashed",
      sendVerificationOnSignUp: true,
      overrideDefaultEmailVerification: false,
      sendVerificationOTP: async ({ email, otp }) => {
        await sendEmail(env, buildAuthEmail({ kind: "email-otp", to: email, otp }));
      },
    }),
  ];

  if (env.CAPTCHA_PROVIDER === "cloudflare-turnstile" && env.CAPTCHA_SECRET_KEY) {
    plugins.push(
      captcha({
        provider: "cloudflare-turnstile",
        secretKey: env.CAPTCHA_SECRET_KEY,
        endpoints: ["/sign-up/email", "/sign-in/email", "/forget-password"],
      }),
    );
  }

  const genericProviders = createGenericOAuthProviders(env);
  if (genericProviders.length > 0) {
    plugins.push(genericOAuth({ config: genericProviders }));
  }

  return plugins;
}