// src/lib/api/customer-portal-auth.ts
import { customerPortalTokenStorage } from "@/src/lib/api/customer-portal-storage"

export type CustomerPortalTokenPair = {
  access: string
  refresh: string
  must_change_password: boolean
}

function joinUrl(base: string, path: string) {
  const b = (base || "").replace(/\/+$/, "")
  const p = (path || "").replace(/^\/+/, "")
  return `${b}/${p}`
}

async function safeJson(res: Response) {
  const ct = res.headers.get("content-type") || ""
  if (!ct.includes("application/json")) return null
  try {
    return await res.json()
  } catch {
    return null
  }
}

/**
 * Login portail client (endpoint dédié — bloque admins et agents sans CustomerMembership)
 */
export async function customerPortalLogin(payload: {
  username: string
  password: string
}): Promise<CustomerPortalTokenPair> {
  const base = process.env.NEXT_PUBLIC_API_BASE_URL || ""
  const url = joinUrl(base, "/auth/client-portal/token/")

  const res = await fetch(url, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(payload),
  })

  const data = await safeJson(res)

  if (!res.ok) {
    const msg = data?.detail || data?.message || "Invalid credentials."
    throw new Error(msg)
  }

  // res attendu: { access, refresh }
  if (!data?.access || !data?.refresh) {
    throw new Error("Invalid token response from server.")
  }

  customerPortalTokenStorage.setTokens(data.access, data.refresh)
  return {
    access: data.access,
    refresh: data.refresh,
    must_change_password: !!data.must_change_password,
  }
}

export function customerPortalLogout() {
  customerPortalTokenStorage.clear()
}