<?php

declare(strict_types=1);

namespace Maestro\Core\Services;

use Illuminate\Contracts\Auth\Authenticatable;
use Illuminate\Database\Eloquent\Model;
use Maestro\Core\Support\AuthUserResolver;

/**
 * Resolves users for Microsoft Entra SSO.
 *
 * Users must be pre-provisioned with {@see $user->microsoft_user_id} set to their Azure object id (oid).
 * Just-in-time account creation is intentionally not implemented — same policy as Top Level Punt.
 */
final class MicrosoftAuthService
{
    /**
     * @return (Model&Authenticatable)|null
     */
    public function findUserByMicrosoftId(string $microsoftUserId): ?Model
    {
        $class = AuthUserResolver::eloquentModelClass();

        return $class::query()
            ->where('microsoft_user_id', $microsoftUserId)
            ->where('is_active', true)
            ->first();
    }
}
