// app/ssr.tsx
import { createStart } from "@tanstack/react-start";
import { createInAIAuthMiddleware } from "@inai-dev/tanstack-start/middleware";

const authMiddleware = createInAIAuthMiddleware({
  publicRoutes: ["/", "/about", "/login", "/register"],
  signInUrl: "/login",
  // onUnauthorized: "null",  // pass auth: null instead of redirecting (useful for API routes)
  // jwksUrl: "https://apiauth.inai.dev/.well-known/jwks.json", // optional override
});

export default createStart(() => ({
  requestMiddleware: [authMiddleware],
}));

// routes/api/auth/$path.ts
import { createFileRoute } from "@tanstack/react-router";
import { createAuthRouteHandlers } from "@inai-dev/tanstack-start/server";

const { handleRequest } = createAuthRouteHandlers();

export const Route = createFileRoute("/api/auth/$path")({
  server: {
    handlers: {
      POST: ({ request, params }) => handleRequest(request, params.path),
    },
  },
});

import { createServerFn } from "@tanstack/react-start";
import { auth } from "@inai-dev/tanstack-start/server";

const getDashboard = createServerFn({ method: "GET" }).handler(() => {
  const { userId, has, protect, redirectToSignIn, getToken } = auth();

  // Check if user is authenticated
  if (!userId) {
    redirectToSignIn({ returnTo: "/dashboard" });
  }

  // Check roles/permissions
  if (has({ role: "admin" })) {
    // admin-only logic
  }

  // Protect — throws redirect if unauthorized
  const authed = protect({ permission: "posts:write" });

  return { userId };
});

import { createServerFn } from "@tanstack/react-start";
import { currentUser } from "@inai-dev/tanstack-start/server";

const getProfile = createServerFn({ method: "GET" }).handler(async () => {
  const user = await currentUser();
  if (!user) return null;
  return { email: user.email };
});

// Force a fresh fetch from the API (bypasses cached session cookie)
const freshUser = await currentUser({ fresh: true });

import { createServerFn } from "@tanstack/react-start";
import { createInAIAuthFnMiddleware } from "@inai-dev/tanstack-start/middleware";

const authFn = createInAIAuthFnMiddleware();

const getProfile = createServerFn({ method: "GET" })
  .middleware([authFn])
  .handler(({ context }) => {
    if (!context.auth) throw Response.json({ error: "Unauthorized" }, { status: 401 });
    return fetchProfile(context.auth.userId);
  });

import { createServerFn } from "@tanstack/react-start";
import {
  createInAIAuthFnMiddleware,
  requireAuth,
} from "@inai-dev/tanstack-start/middleware";

const authFn = createInAIAuthFnMiddleware();

const adminAction = createServerFn({ method: "POST" })
  .middleware([authFn, requireAuth({ role: "admin" })])
  .handler(({ context }) => {
    // context.auth is guaranteed non-null with "admin" role
    return performAdminAction(context.auth.userId);
  });

const { isLoaded, isSignedIn, userId, roles, permissions, has, signOut } = useAuth();

has({ role: "admin" });       // check role
has({ permission: "read" });  // check permission
await signOut();

const { isLoaded, isSignedIn, user } = useUser();
// user: UserResource | null

const { isLoaded, isSignedIn, userId, tenantId, orgId, orgRole } = useSession();

const { isLoaded, orgId, orgRole } = useOrganization();

const { signIn, isLoading, error, status, reset } = useSignIn();

await signIn.create({ identifier: "user@example.com", password: "..." });
// status: "idle" | "loading" | "needs_mfa" | "complete" | "error"

// MFA flow
await signIn.attemptMFA({ code: "123456" });

const { signUp, isLoading, error, status, reset } = useSignUp();

await signUp.create({
  email: "user@example.com",
  password: "...",
  firstName: "Jane",
  lastName: "Doe",
});
// status: "idle" | "loading" | "needs_email_verification" | "complete" | "error"

import { configureAuth, getAuthConfig } from "@inai-dev/tanstack-start/server";

configureAuth({
  signInUrl: "/login",
  signUpUrl: "/register",
  afterSignInUrl: "/dashboard",
  afterSignOutUrl: "/",
  publishableKey: "pk_live_...",
});

const config = getAuthConfig();
// { signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, publishableKey }

import { createRouteMatcher } from "@inai-dev/tanstack-start/middleware";

const isPublic = createRouteMatcher(["/", "/about", "/api/(.*)"]);

const authMiddleware = createInAIAuthMiddleware({
  publicRoutes: isPublic,
});

import { createInAIAuthMiddleware } from "@inai-dev/tanstack-start/middleware";

const authMiddleware = createInAIAuthMiddleware({
  publicRoutes: ["/", "/login"],
  signInUrl: "/login",
  beforeAuth: (request) => {
    // Runs before auth check — return a Response to short-circuit
  },
  afterAuth: (auth, request) => {
    // Runs after auth check on protected routes
    const pathname = new URL(request.url).pathname;
    if (auth.userId && pathname === "/login") {
      return Response.redirect(new URL("/dashboard", request.url));
    }
  },
});

// Middleware
const authMiddleware = createInAIAuthMiddleware({
  authMode: "platform",
  publicRoutes: ["/login"],
});

// API routes
import { createPlatformAuthRouteHandlers } from "@inai-dev/tanstack-start/server";

const { handleRequest } = createPlatformAuthRouteHandlers();

export const Route = createFileRoute("/api/platform/auth/$path")({
  server: {
    handlers: {
      GET: ({ request, params }) => handleRequest(request, params.path),
      POST: ({ request, params }) => handleRequest(request, params.path),
    },
  },
});

import type {
  AuthObject,
  ServerAuthObject,
  ProtectedAuthObject,
  UserResource,
  PlatformUserResource,
  SessionResource,
  OrganizationResource,
  InAIAuthConfig,
  InAIAuthErrorBody,
  SignInResult,
  SignUpResult,
} from "@inai-dev/tanstack-start";

import type {
  InAITanStackMiddlewareConfig,
  RequireAuthConfig,
} from "@inai-dev/tanstack-start/middleware";