blockchain/apps/portal/lib/auth.ts

import { createBrivenAuth, type BrivenAuthClient } from "@briven/auth";

import {
  getBrivenAuthPublicKey,
  getBrivenProjectId,
  isBrivenAuthConfigured,
} from "@/lib/auth-config";

/**
 * First-party origin for the browser SDK.
 * Browser must NOT call api.briven.tech directly (CORS → "network error").
 * Calls go: same host /api/auth/* → route proxy → Briven FDI.
 */
function getAuthApiOrigin(): string {
  // Browser: same origin + /api/auth (route handler proxies FDI)
  if (typeof window !== "undefined") {
    const optOut =
      process.env.NEXT_PUBLIC_BRIVEN_AUTH_FIRST_PARTY === "0";
    if (!optOut) {
      return `${window.location.origin}/api/auth`;
    }
  }
  // Server-side SDK use (rare): talk to Briven directly
  return (
    process.env.BRIVEN_API_ORIGIN ||
    process.env.NEXT_PUBLIC_BRIVEN_API_ORIGIN ||
    "https://api.briven.tech"
  ).replace(/\/$/, "");
}

/**
 * Stateless Briven client. Session cookies set via first-party proxy.
 * https://docs.briven.tech/auth
 */
export function getBrivenAuth(): BrivenAuthClient | null {
  if (!isBrivenAuthConfigured()) return null;
  const projectId = getBrivenProjectId()!;
  const publicKey = getBrivenAuthPublicKey()!;
  return createBrivenAuth({
    projectId,
    publicKey,
    apiOrigin: getAuthApiOrigin(),
  });
}

/** Scaffold-compatible export — may be null until keys are set. */
export const auth = getBrivenAuth();