// ─── Entra org tenant — staff only ───────────────────────────────────────────
const TENANT_ID = '0be4c23a-6941-4bdb-b397-a4faf88de4b3';

// MediaPoint-Admin app registration clientId (Admin SPA — NOT the Graph API app)
// b0f29246... is the Graph API server app — replace this with the correct value
// from Entra portal → App Registrations → MediaPoint-Admin → Application (client) ID
const CLIENT_ID = 'b0f29246-91e7-4615-96db-5de9b6f8da2e'; // TODO: replace with MediaPoint-Admin clientId

const AUTHORITY = `https://login.microsoftonline.com/${TENANT_ID}`;

// ─── Management API resource ──────────────────────────────────────────────────
// This is the audience for access tokens sent to Management API.
// Scope requests this audience so tokens carry the `roles` claim.
export const MGMT_APP_ID    = '4e4d69c3-558a-4a27-a689-17bd397175e5'; // MediaPoint-Management appId
export const MGMT_SCOPE     = `api://${MGMT_APP_ID}/access_as_user`;

// ─── URLs ─────────────────────────────────────────────────────────────────────
export const MANAGEMENT_URL   = 'https://adpmgmt.usimdev.com';
export const REGISTRATION_URL = 'https://adpregist.usimdev.com';

// ─── MSAL configuration ───────────────────────────────────────────────────────
export const msalConfig = {
  auth: {
    clientId: CLIENT_ID,
    authority: AUTHORITY,
    redirectUri: window.location.origin,
    postLogoutRedirectUri: window.location.origin,
    knownAuthorities: ['login.microsoftonline.com'],
    navigateToLoginRequestUrl: true,
  },
  cache: {
    cacheLocation: 'localStorage',
    storeAuthStateInCookie: false,
  },
  system: {
    loggerOptions: {
      loggerCallback: (level, message, containsPii) => {
        if (containsPii) return;
        if (level === 0) console.error(message);
        else if (level === 1) console.warn(message);
      },
      logLevel: 1, // warn + error only
    },
  },
};

// Login request — include Management API scope so access tokens carry `roles`
export const loginRequest = {
  scopes: ['openid', 'profile', 'email', MGMT_SCOPE],
  prompt: 'select_account',
};

// ─── Aliases ──────────────────────────────────────────────────────────────────
export const MGMT_BASE = MANAGEMENT_URL;
