dorfteich/apps/api/src/auth/auth.module.ts

import { Logger, Module, OnModuleInit } from '@nestjs/common';
import { APP_GUARD } from '@nestjs/core';

import { AppConfig } from '../config/app-config.service';
import { GrantsModule } from '../grants/grants.module';
import { InvitationsModule } from '../invitations/invitations.module';

import { MailModule } from '../mail/mail.module';
import { PondsModule } from '../ponds/ponds.module';
import { UsersModule } from '../users/users.module';
import { AuthController } from './auth.controller';
import { AuthGuard } from './auth.guard';
import { AuthService } from './auth.service';
import { AuthTokensService } from './auth-tokens.service';
import { ClaimMappingService } from './claim-mapping.service';
import { OidcController } from './oidc.controller';
import { OidcService } from './oidc.service';
import { ProxyIdentityService } from './proxy-identity.service';
import { SessionsModule } from './sessions.module';

@Module({
  imports: [UsersModule, MailModule, SessionsModule, PondsModule, GrantsModule, InvitationsModule],
  controllers: [AuthController, OidcController],
  providers: [
    AuthService,
    AuthTokensService,
    ClaimMappingService,
    OidcService,
    ProxyIdentityService,
    // Global default-protected: every route needs a session unless it
    // opts out with @Public().
    { provide: APP_GUARD, useClass: AuthGuard },
  ],
  exports: [AuthTokensService, AuthService, OidcService],
})
export class AuthModule implements OnModuleInit {
  constructor(
    private readonly config: AppConfig,
    private readonly oidc: OidcService,
    private readonly proxyIdentity: ProxyIdentityService,
  ) {}

  onModuleInit(): void {
    // #216: local auth off without ANY external path means nobody can ever
    // sign in — loudly stated at boot, because the operator will otherwise
    // discover it at the login screen.
    if (!this.config.env.AUTH_LOCAL_ENABLED && !this.oidc.enabled && !this.proxyIdentity.enabled) {
      new Logger(AuthModule.name).warn(
        'AUTH_LOCAL_ENABLED=false with neither OIDC nor proxy authentication configured — no sign-in path exists',
      );
    }
  }
}