env.mjs

import { z } from "zod";

const envSchema = z.object({
  NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
  DATABASE_URL: z
    .string()
    .min(1, "DATABASE_URL is required. Example: DATABASE_URL=file:./prisma/decks.db"),
  AUTH_SECRET: z
    .string()
    .min(32, "AUTH_SECRET must be at least 32 characters. Generate with `openssl rand -base64 32`."),
  GOOGLE_CLIENT_ID: z.string().optional(),
  GOOGLE_CLIENT_SECRET: z.string().optional(),
  LIBSQL_URL: z.string().optional(),
  LIBSQL_AUTH_TOKEN: z.string().optional(),
  ADMIN_EMAIL: z.string().email("ADMIN_EMAIL must be a valid email address."),
  ADMIN_DISPLAY_NAME: z.string().optional(),
  ADMIN_PASSWORD: z.string().optional(),
  ADMIN_API_KEY: z.string().optional(),
}).superRefine((data, ctx) => {
  const hasGoogleClientId = Boolean(data.GOOGLE_CLIENT_ID?.trim());
  const hasGoogleClientSecret = Boolean(data.GOOGLE_CLIENT_SECRET?.trim());
  const hasGoogleAuth = hasGoogleClientId || hasGoogleClientSecret;
  const hasPasswordAuth = Boolean(data.ADMIN_PASSWORD?.trim());

  if (hasGoogleClientId !== hasGoogleClientSecret) {
    ctx.addIssue({
      code: z.ZodIssueCode.custom,
      path: ["GOOGLE_CLIENT_ID"],
      message: "Set both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET together, or omit both.",
    });
  }

  if (!hasGoogleAuth && !hasPasswordAuth) {
    ctx.addIssue({
      code: z.ZodIssueCode.custom,
      path: ["ADMIN_PASSWORD"],
      message: "Configure at least one sign-in method: Google OAuth or ADMIN_PASSWORD.",
    });
  }
});

const parsed = envSchema.safeParse(process.env);

if (!parsed.success) {
  console.error("❌ Invalid environment variables:", parsed.error.flatten().fieldErrors);
  throw new Error("Environment validation failed");
}

export const env = parsed.data;