// Every in-app Google round-trip starts at one backend route (auth.py `google_connect`): attaching a
// Google sign-in to the account (`identity`), or granting YouTube access on top (`read`, `write`).
// The page navigates away to Google and comes back through the shared callback, which lands on
// `?link=…` (App.tsx) for `identity` and on the app itself for a grant. A navigation carries no
// headers, so it names the account the tab was built for in the query (`expect`) — the check every
// request gets (`identityHeaders`): a tab still showing the account signed in before would otherwise
// attach Google to the one signed in now.

import { claimedAccount } from "./storage";

export const GOOGLE_ACCESS = ["identity", "read", "write"] as const;
export type GoogleAccess = (typeof GOOGLE_ACCESS)[number];

export function googleConnectUrl(access: GoogleAccess): string {
  const params = new URLSearchParams({ access });
  const account = claimedAccount();
  if (account) params.set("expect", account);
  return `/auth/google/connect?${params.toString()}`;
}

/** Leave for Google's sign-in or consent screen. */
export function connectGoogle(access: GoogleAccess): void {
  window.location.href = googleConnectUrl(access);
}