/** Values accepted by the `users.loginMethod` database enum. */
export type LoginMethod = "manus" | "local" | "azure-ad";

const LOGIN_METHODS = new Set<LoginMethod>(["manus", "local", "azure-ad"]);

/**
 * Maps provider-specific identifiers to the limited database enum.
 * OAuth identity payloads are external input and must never be persisted verbatim.
 */
export function normalizeLoginMethod(value: unknown): LoginMethod {
  if (typeof value !== "string") return "manus";

  const normalized = value.trim().toLowerCase();
  if (LOGIN_METHODS.has(normalized as LoginMethod)) {
    return normalized as LoginMethod;
  }

  if (normalized.includes("azure") || normalized.includes("microsoft")) {
    return "azure-ad";
  }

  return "manus";
}