// ---------------------------------------------------------------------------
// Auth / profile API client  (client-side)
// ---------------------------------------------------------------------------
// Identity (login, registration, recovery, verification, password changes,
// account deletion, social sign-in) is owned by Ory Kratos — see
// `src/lib/kratos/`. The honeyDue Go API no longer does auth.
//
// What remains here is the honeyDue *profile* surface, which still lives on
// the Go API and is authenticated by the `ory_kratos_session` cookie:
//   - GET  /auth/me       -> the current user's honeyDue profile
//   - PUT  /auth/profile  -> update honeyDue-side profile fields
// ---------------------------------------------------------------------------

import { apiFetch } from './client';

// ---------------------------------------------------------------------------
// Response shapes
// ---------------------------------------------------------------------------

/**
 * The current user as returned by the honeyDue Go API `GET /auth/me`.
 * The canonical identity (email, verification status) is owned by Kratos;
 * this is the honeyDue-side projection used to render the app UI.
 */
export interface UserResponse {
  id: number;
  username: string;
  email: string;
  first_name: string;
  last_name: string;
  is_email_verified: boolean;
  profile_image_url?: string;
  date_joined: string;
}

export interface UpdateProfileRequest {
  email?: string;
  first_name?: string;
  last_name?: string;
}

// ---------------------------------------------------------------------------
// API functions
// ---------------------------------------------------------------------------

/**
 * Get the currently authenticated user's honeyDue profile.
 * Requires a valid Kratos session (`ory_kratos_session` cookie), which the
 * proxy forwards to the Go API.
 */
export function getCurrentUser(): Promise<UserResponse> {
  return apiFetch<UserResponse>('/auth/me/');
}

/**
 * Update the authenticated user's honeyDue-side profile.
 * Note: changing the email/password of the *identity* itself is done through
 * the Kratos `settings` flow, not here.
 */
export function updateProfile(
  data: UpdateProfileRequest,
): Promise<UserResponse> {
  return apiFetch<UserResponse>('/auth/profile/', {
    method: 'PUT',
    body: JSON.stringify(data),
  });
}

export interface MessageResponse {
  message: string;
}

/**
 * Delete the authenticated user's honeyDue account data.
 *
 * TODO(kratos): This deletes the honeyDue-side data via the Go API. The Kratos
 * *identity* itself must also be removed for a full account deletion. Kratos
 * does not expose a self-service "delete identity" browser flow — that has to
 * be done either by the Go API server-side (admin API) as part of this call,
 * or via a separate admin/back-office process. Verify the Go API's
 * `DELETE /auth/account` also tears down the Kratos identity; if it does not,
 * a follow-up is needed.
 */
export function deleteAccount(): Promise<MessageResponse> {
  return apiFetch<MessageResponse>('/auth/account/', {
    method: 'DELETE',
  });
}
