// ── Local (username/password) provider ─────────────────────────────────────
//
// Reference implementation of the BaseProvider contract for local credential
// auth. It delegates to the existing users model, mirroring what auth.controller
// does today — but it is NOT wired into the live login flow. The controller
// keeps its own login logic (honeypot, bot scoring, TOTP staging, backoff) so
// this refactor changes no behavior. This exists so Part 3 can treat "local" as
// just another provider alongside SSO, behind one uniform interface.

const BaseProvider = require('./base.provider')
const users = require('../../model/users/users.model')

class LocalProvider extends BaseProvider {
  constructor(config = {}) {
    super({ name: 'local', type: 'local', enabled: true, ...config })
  }

  // Verify username + password. Returns the raw user row on success, else null.
  // Callers layer their own throttling/scoring on top (as auth.controller does).
  async authenticate({ username, password } = {}) {
    const user = await users.getRawByUsername(username)
    const ok = user && (await users.validatePassword(user, password))
    return ok ? user : null
  }
}

module.exports = LocalProvider
