// Pre-login read of which SSO providers the operator configured, so the login
// page knows which provider buttons to render. Same boundary as setup-status: a
// plain same-origin fetch that runs before the atom registry exists. Fails soft
// to "no providers" — the email/password form is always available, so a hiccup
// here degrades to the baseline login, never a lockout.

export interface SsoProvider {
  readonly id: string;
  readonly name: string;
}

const isSsoProvider = (value: unknown): value is SsoProvider =>
  typeof value === "object" &&
  value !== null &&
  typeof (value as { id?: unknown }).id === "string" &&
  typeof (value as { name?: unknown }).name === "string";

export const fetchSsoProviders = async (): Promise<readonly SsoProvider[]> => {
  const response = await fetch("/api/auth-config", { credentials: "same-origin" }).then(
    (r) => r,
    () => null,
  );
  if (!response?.ok) return [];
  const data = (await response.json().then(
    (d) => d,
    () => ({}),
  )) as { ssoProviders?: unknown };
  return Array.isArray(data.ssoProviders) ? data.ssoProviders.filter(isSsoProvider) : [];
};