// src/lib/auth-client.ts — Better Auth client (browser).
"use client";
import { stripeClient } from "@better-auth/stripe/client";
import {
  adminClient,
  magicLinkClient,
  organizationClient,
  twoFactorClient,
  usernameClient,
} from "better-auth/client/plugins";
import { createAuthClient } from "better-auth/react";
import { ac, admin, member, owner } from "./permissions";

export const authClient = createAuthClient({
  plugins: [
    organizationClient({ ac, roles: { owner, admin, member } }),
    magicLinkClient(),
    // Route any sign-in that needs a second factor (password, magic-link, …) to
    // the dedicated challenge page. `twoFactorPage` does a full-page redirect,
    // so it catches every entry point, not just the login form.
    twoFactorClient({ twoFactorPage: "/two-factor" }),
    // Enables signIn.username / isUsernameAvailable + the username/displayUsername
    // fields on signUp.email and updateUser.
    usernameClient(),
    // Global admin plugin client — exposes authClient.admin.* (listUsers,
    // banUser, unbanUser, setRole, impersonateUser, …). Our admin UI calls these
    // through server actions (re-asserting assertSuperAdmin), not directly, but
    // the client is wired for completeness + role-permission helpers.
    adminClient(),
    stripeClient({ subscription: true }),
  ],
});