export function isOidcConfigured(): boolean {
  return Boolean(
    process.env.AUTH_OIDC_ISSUER?.trim() &&
      process.env.AUTH_OIDC_CLIENT_ID?.trim() &&
      process.env.AUTH_OIDC_CLIENT_SECRET?.trim()
  );
}

/** Pull an email out of common OIDC claim shapes (Authelia, Keycloak, etc.). */
export function emailFromOidcProfile(
  profile: Record<string, unknown>
): string | null {
  const candidates = [
    profile.email,
    profile.preferred_username,
    profile.upn,
    profile.mail,
    (profile.user as { email?: unknown } | undefined)?.email,
  ];

  for (const value of candidates) {
    if (typeof value !== "string") continue;
    const trimmed = value.trim();
    if (trimmed.includes("@")) return trimmed.toLowerCase();
  }
  return null;
}