import { fetchJson } from "./client";
import type { ApiResult, AuthSession } from "@/types";

export const authAPI = {
  session: (): Promise<ApiResult<AuthSession>> => fetchJson("/auth/session", { timeoutName: "auth session" }),
  bootstrap: (): Promise<ApiResult<AuthSession>> => fetchJson("/auth/bootstrap", { timeoutName: "auth bootstrap" }),
  register: (payload: { email: string; username: string; displayName?: string; password: string }): Promise<ApiResult<AuthSession & { initialCredits?: number | null }>> => fetchJson("/auth/register", {
    method: "POST",
    body: JSON.stringify(payload),
    timeoutName: "auth register",
    timeoutMs: 12000
  }),
  login: (username: string, password: string): Promise<ApiResult<AuthSession>> => fetchJson("/auth/login", {
    method: "POST",
    body: JSON.stringify({ username, password }),
    timeoutName: "auth login"
  }),
  logout: (): Promise<ApiResult<{ ok?: boolean }>> => fetchJson("/auth/logout", { method: "POST", body: JSON.stringify({}) })
};

// HWLAB Web auth deliberately does not mirror Sub2API localStorage token
// refresh. Browser requests stay same-origin and are authorized by the
// server-issued hwlab_session cookie.
export const HWLAB_WEB_SESSION_COOKIE = "hwlab_session";
