import { type SsoConfig } from "../config"; // Better Auth serves OAuth sign-in callbacks at `/oauth2/callback/:providerId`// (genericOAuth) and `/callback/:providerId` (built-in social providers) — the// only paths an IdP-initiated user creation arrives on, so this splits "a// stranger signed in at the IdP" from server-side creation (the seed, admin// add-user), which never carries either.export const isOAuthCallback = (path: string | undefined): boolean =>  path?.startsWith("/oauth2/callback/") === true || path?.startsWith("/callback/") === true; // The domain of a well-formed address, or null — so a malformed email can never// match an allowlist entry (`emailDomain("@example.com")` is null, not "example.com").export const emailDomain = (email: string): string | null => {  const at = email.lastIndexOf("@");  if (at <= 0 || at === email.length - 1) return null;  return email.slice(at + 1).toLowerCase();}; // Admission = the IdP vouches for the address (`email_verified`, mapped to// `emailVerified` by the genericOAuth callback) AND its domain is allowlisted.// Without the verified check, anyone could register an IdP account with a// made-up allowlisted address and walk in.export const isAdmitted = (  sso: SsoConfig,  user: { email: string; emailVerified: boolean },): boolean => {  if (!user.emailVerified) return false;  const domain = emailDomain(user.email);  return domain !== null && sso.allowedDomains.includes(domain);}; // The genericOAuth registration for the configured provider, derived from its// OIDC discovery document. For Google with a single allowed domain, `hd`// pre-filters the account chooser — a UX hint only (Google treats it as// advisory); the create-hook gate is the enforcement.export const ssoProviderConfig = (sso: SsoConfig) => ({  providerId: sso.providerId,  clientId: sso.clientId,  clientSecret: sso.clientSecret,  discoveryUrl: sso.discoveryUrl,  scopes: ["openid", "email", "profile"],  pkce: true,  ...(sso.providerId === "google" && sso.allowedDomains.length === 1    ? { authorizationUrlParams: { hd: sso.allowedDomains[0]! } }    : {}),});