export type Portal = 'student' | 'tenant-admin' | 'platform-admin';

declare const process: {
  env: Record<string, string | undefined>;
};

export const appEnv = {
  portal: (process.env.TARO_APP_PORTAL || 'student') as Portal,
  apiBaseUrl: process.env.TARO_APP_API_BASE_URL || 'http://127.0.0.1:8787',
  supabaseUrl: process.env.TARO_APP_SUPABASE_URL || '',
  supabasePublishableKey: process.env.TARO_APP_SUPABASE_PUBLISHABLE_KEY || '',
  tenantCode: process.env.TARO_APP_TENANT_CODE || '',
};

export function assertFrontendSecretsAreAbsent() {
  const forbidden = [
    'SUPABASE_SERVICE_ROLE_KEY',
    'SUPABASE_SECRET_KEY',
    'DATABASE_URL',
    'ALIYUN_OSS_ACCESS_KEY_SECRET',
    'TENCENT_COS_SECRET_KEY',
    'WECHAT_PAY_PRIVATE_KEY',
    'ALIPAY_APP_PRIVATE_KEY',
    'AUTH_SESSION_SECRET',
    'PLATFORM_ADMIN_API_KEY',
  ];
  const leaked = forbidden.filter(key => process.env[key]);
  if (leaked.length) {
    throw new Error(`Forbidden secret env in Taro build: ${leaked.join(', ')}`);
  }
}