import { getAuthHeaders } from "./api-client";
const API_BASE = (process.env.NEXT_PUBLIC_API_URL || "http://localhost:3333").replace(/\/$/, "") + "/api";

export interface LoginDTO {
  email: string;
  password: string;
}

export interface AuthUser {
  id: string;
  name: string;
  email: string;
  role: string;
  companyId?: string;
  company?: string;
}

export interface AuthResponse {
  token: string;
  user: AuthUser;
}

/** Lê o token da sessão atual (sessionStorage — apagado ao fechar o browser). */
export function getSessionToken(): string | null {
  if (typeof window === "undefined") return null;
  return sessionStorage.getItem("rentx_auth_token");
}

/** Lê o usuário da sessão atual. */
export function getSessionUser(): AuthUser | null {
  if (typeof window === "undefined") return null;
  const raw = sessionStorage.getItem("rentx_user");
  if (!raw) return null;
  try {
    return JSON.parse(raw) as AuthUser;
  } catch {
    return null;
  }
}

/** Persiste token e usuário na sessão (sessionStorage + cookie de sessão sem Max-Age). */
function persistSession(token: string, user: AuthUser): void {
  // sessionStorage: apagado automaticamente ao fechar a aba/navegador
  sessionStorage.setItem("rentx_auth_token", token);
  sessionStorage.setItem("rentx_user", JSON.stringify(user));

  // Cookie de sessão (sem Max-Age/Expires): o browser apaga ao encerrar
  // SameSite=Lax é seguro para SPAs no mesmo domínio
  document.cookie = `rentx_session=1; path=/; SameSite=Lax`;
  document.cookie = `rentx_role=${user.role}; path=/; SameSite=Lax`;
}

/** Remove todos os dados da sessão (cookie + sessionStorage). */
export function logoutUser(): void {
  if (typeof window === "undefined") return;
  sessionStorage.removeItem("rentx_auth_token");
  sessionStorage.removeItem("rentx_user");
  // Expirar os cookies imediatamente
  document.cookie = "rentx_session=; path=/; SameSite=Lax; Max-Age=0";
  document.cookie = "rentx_role=; path=/; SameSite=Lax; Max-Age=0";
}

export async function loginUser(data: LoginDTO): Promise<AuthResponse> {
  const normalizedEmail = (data.email || "").trim().toLowerCase();
  const isDevMasterUser =
    (normalizedEmail === "admin@rentx.local" ||
      normalizedEmail === "superadmin@rentx.local" ||
      normalizedEmail === "superadmin@blackloc.com") &&
    data.password === "admin123";

  try {
    const res = await fetch(`${API_BASE}/auth/login`, {
      method: "POST",
      headers: getAuthHeaders(),
      body: JSON.stringify(data),
    });

    if (res.ok) {
      const responseData = await res.json();
      const token: string = responseData.accessToken || responseData.token;
      if (token) {
        const user: AuthUser = {
          id: responseData.user?.id ?? "usr-api",
          name: responseData.user?.name ?? data.email,
          email: responseData.user?.email ?? data.email,
          role: responseData.user?.role ?? "SUPERADMIN",
          companyId: responseData.user?.companyId,
          company: responseData.user?.company,
        };
        persistSession(token, user);
        return { token, user };
      }
    } else {
      const errorData = await res.json().catch(() => null);
      if (errorData?.message) {
        throw new Error(errorData.message);
      }
      throw new Error(`Erro de autenticação: ${res.status}`);
    }
  } catch (err: any) {
    if (err.message && err.message !== "Failed to fetch") {
      throw err;
    }
    // fallback se a API estiver fora do ar
  }

  // Fallback direto para credenciais mestres padrão
  if (isDevMasterUser) {
    const mockUser: AuthUser = {
      id: "usr-superadmin",
      name: "SuperAdmin Master",
      email: data.email,
      role: "SUPERADMIN",
    };
    const mockToken = "mock-jwt-" + Date.now();
    persistSession(mockToken, mockUser);
    return { token: mockToken, user: mockUser };
  }

  throw new Error("Credenciais inválidas. Verifique seu e-mail e senha.");
}