// The sign-in funnel: public auth config, email+password register/login/reset, email verification,
// session management, access requests, and the hidden demo login. Errors on the interactive paths
// are surfaced inline (quiet) rather than via the global modal. Only touches core's req.
import { req } from "./core";

export const authApi = {
  // Public: which sign-in options this instance offers (e.g. hide Google when not configured).
  authConfig: (): Promise<{
    google_enabled: boolean;
    allow_registration: boolean;
    operator_contact: string | null;
  }> => req("/auth/config"),

  // --- email + password (errors handled inline via quiet) ---
  register: (email: string, password: string): Promise<{ status: string }> =>
    req(
      "/auth/register",
      { method: "POST", body: JSON.stringify({ email, password }) },
      { quiet: true },
    ),
  passwordLogin: (email: string, password: string): Promise<{ ok: boolean }> =>
    req(
      "/auth/password-login",
      { method: "POST", body: JSON.stringify({ email, password }) },
      { quiet: true },
    ),
  requestPasswordReset: (email: string): Promise<{ status: string }> =>
    req(
      "/auth/password-reset/request",
      { method: "POST", body: JSON.stringify({ email }) },
      { quiet: true },
    ),
  confirmPasswordReset: (token: string, password: string): Promise<{ ok: boolean }> =>
    req(
      "/auth/password-reset/confirm",
      { method: "POST", body: JSON.stringify({ token, password }) },
      { quiet: true },
    ),
  // Confirm an email-verification token the SPA read from the URL fragment (SB3).
  verifyEmail: (token: string): Promise<{ ok: boolean }> =>
    req("/auth/verify", { method: "POST", body: JSON.stringify({ token }) }, { quiet: true }),
  // Re-issue a verification link (the first one expired, or was lost). Uniform response — never
  // reveals whether the email has a pending account.
  resendVerification: (email: string): Promise<{ status: string }> =>
    req(
      "/auth/verify/resend",
      { method: "POST", body: JSON.stringify({ email }) },
      { quiet: true },
    ),
  // SA4: sign every OTHER session for this account out (keeps the current one).
  logoutOthers: (): Promise<{ ok: boolean }> => req("/auth/logout-others", { method: "POST" }),
  // Set or change the signed-in account's password (errors shown inline via quiet).
  setPassword: (password: string, currentPassword?: string): Promise<{ ok: boolean }> =>
    req(
      "/auth/set-password",
      { method: "POST", body: JSON.stringify({ password, current_password: currentPassword }) },
      { quiet: true },
    ),

  // --- onboarding: access requests + demo entry ---
  requestAccess: (email: string): Promise<{ status: string }> =>
    req("/auth/request-access", { method: "POST", body: JSON.stringify({ email }) }),
  // Hidden demo entry: a whitelisted email logs into the shared demo account, no Google
  // sign-in. Returns whether a session was established.
  demoLogin: (email: string): Promise<{ authenticated: boolean }> =>
    req("/auth/demo", { method: "POST", body: JSON.stringify({ email }) }),
};
