/**
 * sh-mcp-ops AuthProvider selection.
 *
 * `aws`   → CognitoAuthProvider (real JWT verification, design.md §2.5).
 * `local` → LocalAuthProvider (dev bearer tokens; refuses to build unless
 *           SH_MCP_ENV=local, build-plan §3).
 */

import {
  CognitoAuthProvider,
  LocalAuthProvider,
  defaultLocalPrincipals,
  type AuthProvider,
} from '@sh-mcp/shared';

import type { OpsConfig } from './config.js';

export function buildOpsAuthProvider(config: OpsConfig): AuthProvider {
  if (config.env === 'aws') {
    if (!config.cognito) {
      throw new Error('Cognito config missing in aws mode.');
    }
    return new CognitoAuthProvider(config.cognito);
  }
  return new LocalAuthProvider({
    audience: config.audience,
    principals: defaultLocalPrincipals(),
    env: 'local',
  });
}