apiClient.ts

import { NextRequest } from "next/server";
import { AUTH_EXPIRED_EVENT, COOKIE_KEYS } from "@/app/lib/constants";

const BACKEND_URL = process.env.BACKEND_URL || "http://localhost:8000";

function readCookieHeader(cookieHeader: string, name: string): string {
  for (const part of cookieHeader.split(";")) {
    const eq = part.indexOf("=");
    if (eq === -1) continue;
    if (part.slice(0, eq).trim() === name) {
      return decodeURIComponent(part.slice(eq + 1).trim());
    }
  }
  return "";
}

export function getRequestApiKey(request: NextRequest | Request): string {
  const header = request.headers.get("X-API-KEY");
  if (header) return header;
  const cookieHeader = request.headers.get("Cookie") || "";
  return readCookieHeader(cookieHeader, COOKIE_KEYS.API_KEY);
}
export type UploadPhase = "uploading" | "processing" | "done";
type ApiClientOptions<TResponseType extends "json" | "raw" = "json"> =
  RequestInit & { responseType?: TResponseType };
type ApiClientJsonResponse<TData = unknown> = {
  status: number;
  data: TData | null;
  headers: Headers;
};
type ApiClientResponse<
  TData,
  TResponseType extends "json" | "raw",
> = TResponseType extends "raw" ? Response : ApiClientJsonResponse<TData>;

let refreshPromise: Promise<boolean> | null = null;

/**
 * Forwards a request to the backend, relaying auth headers (X-API-KEY, Cookie).
 * Returns either a parsed JSON payload or the raw backend response.
 */
export async function apiClient<
  TData = unknown,
  TResponseType extends "json" | "raw" = "json",
>(
  request: NextRequest | Request,
  endpoint: string,
  options: ApiClientOptions<TResponseType> = {} as ApiClientOptions<TResponseType>,
): Promise<ApiClientResponse<TData, TResponseType>> {
  const { responseType = "json", ...requestOptions } = options;
  const apiKey = getRequestApiKey(request);
  const cookie = request.headers.get("Cookie") || "";
  const headers = new Headers(requestOptions.headers);
  if (
    requestOptions.body !== undefined &&
    !(requestOptions.body instanceof FormData) &&
    !headers.has("Content-Type")
  ) {
    headers.set("Content-Type", "application/json");
  }
  headers.set("X-API-KEY", apiKey);
  if (cookie) headers.set("Cookie", cookie);

  const response = await fetch(`${BACKEND_URL}${endpoint}`, {
    ...requestOptions,
    headers,
    credentials: "include",
  });

  if (responseType === "raw") {
    return response as ApiClientResponse<TData, TResponseType>;
  }

  const text = response.status === 204 ? "" : await response.text();
  const data: unknown = text ? JSON.parse(text) : null;

  return {
    status: response.status,
    data: data as TData | null,
    headers: response.headers,
  } as ApiClientResponse<TData, TResponseType>;
}

function stringifyValidationDetail(value: unknown): string {
  if (!Array.isArray(value)) {
    return typeof value === "string" ? value : "";
  }
  return value
    .map((item) => {
      if (typeof item === "string") return item;
      if (item && typeof item === "object") {
        const rec = item as Record<string, unknown>;
        const field = Array.isArray(rec.loc)
          ? rec.loc.filter((p) => p !== "body").join(".")
          : (rec.field as string) || "";
        const msg = (rec.msg as string) || (rec.message as string) || "";
        return field ? `${field}: ${msg}` : msg;
      }
      return "";
    })
    .filter(Boolean)
    .join("; ");
}

function extractErrorMessage(
  body: Record<string, unknown>,
  fallback: string,
): string {
  const detail =
    stringifyValidationDetail(body.errors) ||
    (typeof body.detail === "string"
      ? ""
      : stringifyValidationDetail(body.detail));
  const msg =
    (body.error as string) ||
    (body.message as string) ||
    (typeof body.detail === "string" ? (body.detail as string) : "") ||
    "";
  const combined = [msg, detail].filter(Boolean).join(" — ");
  return combined || fallback;
}

/** Dispatch the auth-expired event (client-side only). */
function dispatchAuthExpired() {
  if (typeof window !== "undefined") {
    window.dispatchEvent(new CustomEvent(AUTH_EXPIRED_EVENT));
  }
}

/** Attempt a silent token refresh. Returns true if new cookies were set. */
async function tryRefreshToken(): Promise<boolean> {
  if (refreshPromise) return refreshPromise;

  refreshPromise = (async () => {
    try {
      const res = await fetch("/api/v1/auth/refresh", {
        method: "POST",
        credentials: "include",
      });
      return res.ok;
    } catch {
      return false;
    }
  })().finally(() => {
    refreshPromise = null;
  });

  return refreshPromise;
}

/**
 * Upload a file with real-time progress tracking.
 *
 * Works with a streaming proxy endpoint that sends newline-delimited JSON:
 *   { phase: "uploading", progress: 42 }   — bytes consumed by backend
 *   { phase: "processing" }                 — backend is processing the file
 *   { done: true, status, data }            — final response
 *   { error: "message" }                    — failure
 *
 * Returns `{ promise, abort }` so callers can cancel in-flight uploads.
 */
export function uploadWithProgress<T>(
  url: string,
  apiKey: string,
  body: FormData,
  onProgress: (percent: number, phase: UploadPhase) => void,
): { promise: Promise<T>; abort: () => void } {
  const controller = new AbortController();

  const promise = (async () => {
    const res = await fetch(url, {
      method: "POST",
      headers: { "X-API-KEY": apiKey },
      body,
      signal: controller.signal,
    });

    if (!res.body) throw new Error("No response stream");

    const reader = res.body.getReader();
    const decoder = new TextDecoder();
    let buffer = "";
    let result: T | null = null;

    while (true) {
      const { done, value } = await reader.read();
      if (done) break;

      buffer += decoder.decode(value, { stream: true });
      const lines = buffer.split("\n");
      buffer = lines.pop() || "";

      for (const line of lines) {
        if (!line.trim()) continue;
        const event = JSON.parse(line);

        if (event.error) {
          throw new Error(event.error);
        }
        if (event.phase === "uploading" && event.progress !== undefined) {
          onProgress(event.progress, "uploading");
        }
        if (event.phase === "processing") {
          onProgress(100, "processing");
        }
        if (event.done) {
          onProgress(100, "done");
          if (event.status >= 400) {
            const msg =
              event.data?.error ||
              event.data?.message ||
              event.data?.detail ||
              `Upload failed: ${event.status}`;
            throw new Error(msg);
          }
          result = event.data as T;
        }
      }
    }

    if (!result) throw new Error("No response received from server");
    return result;
  })();

  return { promise, abort: () => controller.abort() };
}

/**
 * Options accepted by `apiFetch`. Extends `RequestInit` with one extra knob:
 */
export type ApiFetchOptions = RequestInit & { acceptEmpty?: boolean };

/**
 * Client-side fetch helper for Next.js route handlers (/api/*).
 *
 * - Attaches X-API-KEY header and `credentials: "include"` for cookie auth.
 * - On **403 "revoked"**: forces immediate logout (no refresh).
 * - On **401**: tries a silent token refresh, retries once, then logs out.
 * - All other errors are thrown as-is.
 * Default return type is `Promise<T>`. Pass `{ acceptEmpty: true }` to opt
 * into `Promise<T | null>` (returns null on 204).
 */
export async function apiFetch<T>(
  url: string,
  apiKey: string,
  options?: RequestInit,
): Promise<T>;
export async function apiFetch<T>(
  url: string,
  apiKey: string,
  options: ApiFetchOptions & { acceptEmpty: true },
): Promise<T | null>;
export async function apiFetch<T>(
  url: string,
  apiKey: string,
  options: ApiFetchOptions = {},
): Promise<T | null> {
  const { acceptEmpty, ...fetchOptions } = options;

  const buildHeaders = () => {
    const headers = new Headers(fetchOptions.headers);
    if (!(fetchOptions.body instanceof FormData)) {
      headers.set("Content-Type", "application/json");
    }
    if (apiKey) headers.set("X-API-KEY", apiKey);
    return headers;
  };

  const doFetch = () =>
    fetch(url, {
      ...fetchOptions,
      headers: buildHeaders(),
      credentials: "include",
    });

  const res = await doFetch();

  if (res.ok) {
    if (acceptEmpty && res.status === 204) return null;
    return (await res.json()) as T;
  }

  const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
  const message = extractErrorMessage(body, `Request failed: ${res.status}`);

  // 403 with "revoked" → force logout, no refresh attempt
  if (res.status === 403 && message.toLowerCase().includes("revoked")) {
    dispatchAuthExpired();
    throw new Error(message.trim() || "Access revoked. Please log in again.");
  }

  // Non-401 errors → throw immediately
  if (res.status !== 401) {
    throw new Error(message);
  }

  if (url.startsWith("/api/auth/")) {
    throw new Error(message);
  }

  // 401 → attempt silent token refresh, then retry once
  const refreshed = await tryRefreshToken();

  if (refreshed) {
    const retry = await doFetch();
    if (retry.ok) {
      if (acceptEmpty && retry.status === 204) return null;
      return (await retry.json()) as T;
    }

    const retryBody = (await retry.json().catch(() => ({}))) as Record<
      string,
      unknown
    >;
    throw new Error(
      extractErrorMessage(retryBody, `Request failed: ${retry.status}`),
    );
  }

  // Refresh failed → both tokens expired, force logout
  dispatchAuthExpired();
  throw new Error("Session expired. Please log in again.");
}

/**
 * Authenticated fetch that returns the raw `Response`, with the same
 * X-API-KEY + cookie + silent-refresh-on-401 behaviour as `apiFetch`.
 */
export async function apiFetchResponse(
  url: string,
  apiKey: string,
  options: RequestInit = {},
): Promise<Response> {
  const buildHeaders = () => {
    const headers = new Headers(options.headers);
    if (apiKey) headers.set("X-API-KEY", apiKey);
    return headers;
  };

  const doFetch = () =>
    fetch(url, {
      ...options,
      headers: buildHeaders(),
      credentials: "include",
    });

  const res = await doFetch();
  if (res.ok || res.status !== 401) return res;

  // Auth endpoints — never auto-refresh.
  if (url.startsWith("/api/auth/")) return res;

  const refreshed = await tryRefreshToken();
  if (refreshed) return doFetch();

  dispatchAuthExpired();
  return res;
}