"""Auth wiring for this service.

The framework default (``tonin.auth.verifier()``) builds a
``JwtValidator`` from ``TONIN_AUTH_*`` env vars, falling back to
insecure-dev mode locally. To swap in a different verifier (Okta SDK,
API keys, custom token formats, cookie-based extraction), replace the
body of :func:`verifier` with your own ``TokenVerifier`` impl.

Hand-editing this file is fine — it isn't regenerated by ``codegen.sh``.
"""

from __future__ import annotations

from tonin import auth as _auth


def verifier() -> _auth.TokenVerifier:
    """Build the inbound token verifier.

    Default returns :func:`tonin.auth.verifier` which uses
    ``JwtValidator.from_env()`` and falls back to insecure-dev mode
    when ``TONIN_AUTH_ISSUER`` etc. are unset.
    """
    return _auth.verifier()
