/**
 * OIDC authentication middleware wiring.
 *
 * Configures @hono/oidc-auth for Authelia as the identity provider.
 *
 * Required env vars:
 *   OIDC_AUTH_SECRET          — 32+ char random string for JWT cookie signing (T-02-03)
 *   OIDC_ISSUER               — Authelia base URL (middleware fetches /.well-known/openid-configuration)
 *   OIDC_CLIENT_ID            — registered client ID in Authelia
 *   OIDC_CLIENT_SECRET        — PLAIN text secret (NOT the pbkdf2 hash — see Pitfall 7)
 *   OIDC_REDIRECT_URI         — https://familysync.<domain>/callback
 *   OIDC_AUTH_EXTERNAL_URL    — https://familysync.<domain> — MANDATORY behind Pangolin (Pitfall 1)
 *
 * Session persistence (AUTH-02):
 *   @hono/oidc-auth stores the refresh token in the signed JWT cookie.
 *   Every OIDC_AUTH_REFRESH_INTERVAL (default 15 min) the middleware calls
 *   the token endpoint with the stored refresh token — no iframe required (D-12).
 *   Session lifespan is governed by OIDC_AUTH_EXPIRES (default 1 day) and
 *   Authelia's refresh_token_lifespan.
 *
 * Scopes: openid, profile, email only — no 'groups' scope (D-11).
 *
 * Source: https://github.com/honojs/middleware/tree/main/packages/oidc-auth
 */

export { oidcAuthMiddleware, processOAuthCallback, getAuth } from '@hono/oidc-auth'