providers: [
  GoogleProvider({
    clientId: process.env.GOOGLE_CLIENT_ID!,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
  }),
  GitHubProvider({
    clientId: process.env.GITHUB_CLIENT_ID!,
    clientSecret: process.env.GITHUB_CLIENT_SECRET!,
  }),
  FacebookProvider({
    clientId: process.env.FACEBOOK_CLIENT_ID!,
    clientSecret: process.env.FACEBOOK_CLIENT_SECRET!,
  }),
  AppleProvider({
    clientId: process.env.APPLE_CLIENT_ID!,
    clientSecret: process.env.APPLE_CLIENT_SECRET!,
  }),
]

if (account?.provider && oauthProviders.includes(account.provider) && token.email) {
  const normalizedEmail = (token.email as string).toLowerCase().trim()
  let dbUser = await prisma.user.findUnique({ where: { email: normalizedEmail } })
  if (!dbUser) {
    dbUser = await prisma.user.create({
      data: {
        email: normalizedEmail,
        name: token.name ?? null,
        isEmailVerified: true,
        role: 'CUSTOMER',
      },
    })
  }
  token.id = dbUser.id
  token.role = dbUser.role
}