import { HttpClient } from '@angular/common/http';
import { Injectable, inject } from '@angular/core';
import { Observable } from 'rxjs';
import { environment } from '../../../../environments/environment';
import { AuthChallenge, AuthTokenPair, RefreshTokenRequest, VerifySignatureRequest } from '../models/auth-api.model';

/**
 * Thin HTTP client for the Ed25519 admin auth endpoints documented in
 * docs/AUTH.md. These endpoints do not exist on the backend yet (FUTURE -
 * see docs/backend/BACKEND-INTEGRATION.md §2.5) - calling them today 404s
 * or connection-errors, which AuthService maps to the
 * `backend-unavailable` error screen. No mock/fake responses are fabricated
 * here; this is real HttpClient wiring against the real contract, ready for
 * the moment the backend ships.
 */
@Injectable({ providedIn: 'root' })
export class AuthApiService {
  private readonly http = inject(HttpClient);
  private readonly baseUrl = `${environment.authApiUrl}/api/admin/auth`;

  requestChallenge(): Observable<AuthChallenge> {
    return this.http.get<AuthChallenge>(`${this.baseUrl}/challenge`);
  }

  verifySignature(request: VerifySignatureRequest): Observable<AuthTokenPair> {
    return this.http.post<AuthTokenPair>(`${this.baseUrl}/verify`, request);
  }

  refresh(request: RefreshTokenRequest): Observable<AuthTokenPair> {
    return this.http.post<AuthTokenPair>(`${this.baseUrl}/refresh`, request);
  }

  logout(refreshToken: string): Observable<void> {
    return this.http.post<void>(`${this.baseUrl}/logout`, { refreshToken } satisfies RefreshTokenRequest);
  }
}
