import { AuthApi } from "omsorgcore-client-ts";
import { configFor, callApi } from "./apiClientHelpers.js";

// Kapselt /api/auth/* von omsorgCore über den generierten Client (omsorgcore-client-ts).
// refresh/logout brauchen im Browser keinen Refresh-Token-Parameter - er steckt in der
// HttpOnly-Cookie, die dank credentials:"include" automatisch mitgeschickt wird. Das Backend
// liefert refreshToken trotzdem im Response-Body mit (server-seitige API-Clients wie omsorgWeb
// haben keinen Browser-Cookie-Jar und brauchen ihn dort, siehe omsorgCore/CLAUDE.md) - hier
// bewusst ignoriert, nie in JS-Variablen/localStorage abgelegt (XSS-Schutz).
function toTokenPair(data) {
  return {
    accessToken: data.accessToken,
    expiresAt: data.expiresAt,
    mustChangePassword: !!data.mustChangePassword
  };
}

export async function login(username, password) {
  const api = new AuthApi(configFor(undefined));
  const result = await callApi(api.apiAuthLoginPostRaw({ loginRequest: { username, password } }));
  if (!result.ok) {
    return { ok: false, status: result.status, error: result.error || result.data?.error };
  }
  return { ok: true, ...toTokenPair(result.data) };
}

export async function refresh() {
  const api = new AuthApi(configFor(undefined));
  const result = await callApi(api.apiAuthRefreshPostRaw({}));
  if (!result.ok) return { ok: false, status: result.status };
  return { ok: true, ...toTokenPair(result.data) };
}

export async function logout() {
  const api = new AuthApi(configFor(undefined));
  const result = await callApi(api.apiAuthLogoutPostRaw({}));
  return { ok: result.ok, status: result.status };
}

export async function me(accessToken) {
  const api = new AuthApi(configFor(accessToken));
  const result = await callApi(api.apiAuthMeGetRaw());
  if (!result.ok) return { ok: false, status: result.status };
  return { ok: true, username: result.data.username, role: result.data.role, permissions: result.data.permissions };
}

export async function requestPasswordReset(username) {
  const api = new AuthApi(configFor(undefined));
  const result = await callApi(api.apiAuthForgotPasswordRequestPostRaw({ forgotPasswordRequestRequest: { username } }));
  if (!result.ok) return { ok: false, status: result.status };
  return { ok: true, status: result.data.status };
}

export async function verifyPasswordResetCode(username, pin) {
  const api = new AuthApi(configFor(undefined));
  const result = await callApi(api.apiAuthForgotPasswordVerifyPostRaw({ forgotPasswordVerifyRequest: { username, pin } }));
  if (!result.ok) return { ok: false, status: result.status, error: result.data?.error };
  return { ok: true, resetToken: result.data.resetToken };
}

export async function resetPassword(resetToken, newPassword) {
  const api = new AuthApi(configFor(undefined));
  const result = await callApi(api.apiAuthForgotPasswordResetPostRaw({ forgotPasswordResetRequest: { resetToken, newPassword } }));
  return { ok: result.ok, status: result.status, data: result.data };
}

export async function changePassword(accessToken, currentPassword, newPassword) {
  const api = new AuthApi(configFor(accessToken));
  const result = await callApi(api.apiAuthChangePasswordPostRaw({ changePasswordRequest: { currentPassword, newPassword } }));
  return { ok: result.ok, status: result.status, data: result.data };
}

export async function getPasswordPolicy() {
  const api = new AuthApi(configFor(undefined));
  const result = await callApi(api.apiAuthPasswordPolicyGetRaw());
  if (!result.ok) return { ok: false, status: result.status };
  return { ok: true, minLength: result.data.minLength };
}