"""Local (email + password) auth provider."""

from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.security import verify_password
from app.integrations.auth.base import AuthProvider
from app.models.user import User


class LocalAuthProvider(AuthProvider):
    name = "local"

    async def authenticate(
        self, session: AsyncSession, *, identifier: str, secret: str
    ) -> User | None:
        email = identifier.strip().lower()
        user = (
            await session.execute(
                select(User).where(User.email == email, User.deleted_at.is_(None))
            )
        ).scalar_one_or_none()
        if user is None or user.hashed_password is None:
            return None
        if not verify_password(user.hashed_password, secret):
            return None
        return user