import { authApi } from '../api/modules';

export interface AuthUser {
  id: number;
  username: string;
  role: string;
  role_label?: string;
  permissions: string[];
}

const USER_KEY = 'user';

// Token 存储在 httpOnly cookie 中，JS 无法读取，防 XSS 窃取
// 前端仅用 localStorage 存储用户信息（非敏感），用于判断登录状态和显示

export function getUser(): AuthUser | null {
  const raw = localStorage.getItem(USER_KEY);
  if (!raw) return null;
  try {
    return JSON.parse(raw);
  } catch {
    return null;
  }
}

export function setAuth(user: AuthUser) {
  localStorage.setItem(USER_KEY, JSON.stringify(user));
}

export function clearAuth() {
  localStorage.removeItem(USER_KEY);
}

export async function fetchCurrentUser(): Promise<AuthUser | null> {
  // 通过 /me 接口验证 cookie 是否有效
  try {
    const data = await authApi.me();
    const user: AuthUser = {
      id: data.id,
      username: data.username,
      role: data.role,
      role_label: data.role_label,
      permissions: data.permissions,
    };
    setAuth(user);
    return user;
  } catch {
    clearAuth();
    return null;
  }
}

export function hasPerm(user: AuthUser | null, perm: string): boolean {
  if (!user) return false;
  return user.permissions.includes(perm);
}