/**
 * sh-mcp-finance AuthProvider selection.
 *
 * `aws`   → CognitoAuthProvider with the finance TTL ceiling + finance scope
 *           prefix (design.md §2.5).
 * `local` → LocalAuthProvider (dev bearer tokens; refuses to build unless
 *           SH_MCP_ENV=local).
 */

import {
  CognitoAuthProvider,
  LocalAuthProvider,
  defaultLocalPrincipals,
  type AuthProvider,
} from '@sh-mcp/shared';

import type { FinanceConfig } from './config.js';

export function buildFinanceAuthProvider(config: FinanceConfig): AuthProvider {
  if (config.env === 'aws') {
    if (!config.cognito) {
      throw new Error('Cognito config missing in aws mode.');
    }
    return new CognitoAuthProvider(config.cognito);
  }
  return new LocalAuthProvider({
    audience: config.audience,
    principals: defaultLocalPrincipals(),
    env: 'local',
  });
}