Auth Module

@available(iOS 17.0, *)
public protocol AuthClient: Sendable {
    func signInWithApple() async throws -> AuthUser
    func signInWithGoogle() async throws -> AuthUser
    func signUpWithEmail(email: String, password: String) async throws -> AuthUser
    func signInWithEmail(email: String, password: String) async throws -> AuthUser
    func resetPassword(email: String) async throws
    func signOut() async throws
    func currentUser() async -> AuthUser?
    func authStates() -> AsyncStream<AuthState>
    func refreshIfNeeded() async throws
}

// 1. Configure Supabase (values come from the generated AppConfiguration,
//    built at compile time from Config/Secrets.xcconfig)
let authConfig = AuthConfig(
    supabaseURL: url,                              // AppConfiguration.SUPABASE_URL
    supabaseAnonKey: AppConfiguration.SUPABASE_ANON_KEY
)

// 2. Create HTTP client for Supabase API
let supabaseHTTPClient = Auth.SupabaseHTTPClient(
    baseURL: authConfig.supabaseURL,
    session: .shared
)

// 3. Create Apple Sign In coordinator
let appleSignInCoordinator = Auth.AppleSignInCoordinator()

// 4. Create SessionManager (production auth client)
let sessionManager = Auth.SessionManager(
    httpClient: supabaseHTTPClient,
    keychain: keychainStore,
    apple: appleSignInCoordinator,
    config: authConfig
)

// SessionManager automatically:
// - Loads saved session from Keychain on init
// - Schedules proactive token refresh (60s before expiry)
// - Emits auth state changes via AsyncStream
// - Handles Apple + Email out of the box (Google once a GoogleSignInCoordinator is passed)

// SessionManager handles:
// - Token refresh before expiry
// - Retry on refresh failure
// - Keychain persistence
// - Logout on refresh failure

// Observe auth state changes
for await state in authClient.authStates() {
    switch state {
    case .authenticated(let user):
        // Navigate to authenticated content
    case .unauthenticated:
        // Show sign-in screen
    case .refreshing:
        // Keep the current UI while restoring the session
    }
}

// 1. Add to the AuthClient protocol (Packages/Auth/.../Protocols/AuthClient.swift)
func signInWithGitHub() async throws -> AuthUser

// 2. Implement in SessionManager (Packages/Auth/.../Session/SessionManager+SignIn.swift)
public func signInWithGitHub() async throws -> AuthUser {
    // Exchange the provider token with Supabase, then persist the session
}

// Extend AuthUser (real fields: id, email, name, avatarURL)
struct AuthUser {
    let id: String
    let email: String?
    let name: String?
    let avatarURL: URL?
    var customField: String?  // Add custom fields
}

#if DEBUG
let authBypassValue = ProcessInfo.processInfo.environment["AUTH_BYPASS"]
let shouldUseMock = authBypassValue != "0"  // mock unless explicitly disabled

if shouldUseMock {
    self.sessionManager = Auth.MockAuthClient()
} else {
    // real Supabase + Apple + Email auth …
}
#else
// RELEASE always uses real authentication
#endif