(function (window) {
  'use strict';

  var API_BASE = localStorage.getItem('anivietdb-auth-api') || 'https://sginup-loginsystem.npgia-himlam.workers.dev/';

  var MEM = {};
  var STORE = 'localStorage';
  try {
    if (localStorage.getItem('anivietdb-token')) MEM.token = localStorage.getItem('anivietdb-token');
    if (localStorage.getItem('anivietdb-user')) MEM.user = JSON.parse(localStorage.getItem('anivietdb-user'));
  } catch (e) { /* localStorage might be blocked */ }
  if (!MEM.token) {
    try {
      if (sessionStorage.getItem('anivietdb-token')) MEM.token = sessionStorage.getItem('anivietdb-token');
      if (sessionStorage.getItem('anivietdb-user')) MEM.user = JSON.parse(sessionStorage.getItem('anivietdb-user'));
    } catch (e) { /* ignore */ }
  }

  function save() {
    try {
      if (MEM.token) localStorage.setItem('anivietdb-token', MEM.token);
      else localStorage.removeItem('anivietdb-token');
      if (MEM.user) localStorage.setItem('anivietdb-user', JSON.stringify(MEM.user));
      else localStorage.removeItem('anivietdb-user');
    } catch (e) {
      try {
        if (MEM.token) sessionStorage.setItem('anivietdb-token', MEM.token);
        else sessionStorage.removeItem('anivietdb-token');
        if (MEM.user) sessionStorage.setItem('anivietdb-user', JSON.stringify(MEM.user));
        else sessionStorage.removeItem('anivietdb-user');
      } catch (e2) { /* ignore */ }
    }
  }

  function setSession(data) {
    MEM.token = data && data.token ? data.token : null;
    MEM.user = data && data.user ? data.user : null;
    save();
  }

  function clearSession() {
    MEM.token = null;
    MEM.user = null;
    save();
  }

  var COOLDOWN_MS = 10 * 1000;
  var COOLDOWN_KEY = 'anivietdb-cooldown';

  function setCooldown() {
    try { sessionStorage.setItem(COOLDOWN_KEY, String(Date.now() + COOLDOWN_MS)); } catch (e) { /* ignore */ }
  }

  function cooldownRemaining() {
    try {
      var until = Number(sessionStorage.getItem(COOLDOWN_KEY));
      var r = until - Date.now();
      return r > 0 ? r : 0;
    } catch (e) { return 0; }
  }

  function request(path, method, body) {
    var headers = { 'Content-Type': 'application/json' };
    if (MEM.token) headers['Authorization'] = 'Bearer ' + MEM.token;

    var sep = path.indexOf('?') === -1 ? '?' : '&';
    var url = API_BASE + path + sep + '_t=' + Date.now();
    var init = { method: method || 'GET', headers: headers, cache: 'no-store' };
    if (body) init.body = JSON.stringify(body);

    return fetch(url, init).then(function (resp) {
      return resp.json().catch(function () { return {}; }).then(function (data) {
        if (!resp.ok) {
          var err = new Error((data && data.error) || ('HTTP ' + resp.status));
          err.status = resp.status;
          err.data = data;
          throw err;
        }
        return data;
      });
    });
  }

  function turnstileToken() {
    try {
      if (!window.turnstile || typeof window.turnstile.getResponse !== 'function') return '';
      var widgets = document.querySelectorAll('.cf-turnstile');
      for (var i = 0; i < widgets.length; i++) {
        var el = widgets[i];
        if (el.offsetParent === null) continue;
        return window.turnstile.getResponse(el) || '';
      }
      return '';
    } catch (e) { return ''; }
  }

  window.AuthSystem = {
    baseUrl: API_BASE,

    setBaseUrl: function (url) {
      localStorage.setItem('anivietdb-auth-api', url);
      API_BASE = url;
    },

    isConfigured: function () {
      return !!API_BASE && API_BASE.indexOf('__PASTE') === -1;
    },

    isLoggedIn: function () {
      return !!MEM.token;
    },

    getToken: function () {
      return MEM.token;
    },

    getUser: function () {
      return MEM.user;
    },

    register: function (email, username, password) {
      return request('/api/auth/register', 'POST', { email: email, username: username, password: password, 'cf-turnstile-response': turnstileToken() })
        .then(function (data) { setSession(data); return data; });
    },

    login: function (emailOrUsername, password) {
      return request('/api/auth/login', 'POST', { email: emailOrUsername, password: password, 'cf-turnstile-response': turnstileToken() })
        .then(function (data) { setSession(data); return data; });
    },

    logout: function () {
      return request('/api/auth/logout', 'POST')
        .then(function (data) { clearSession(); setCooldown(); return data; })
        .catch(function () { clearSession(); setCooldown(); });
    },

    cooldownRemaining: cooldownRemaining,

    isAdmin: function () {
      return !!(MEM.user && MEM.user.role === 'admin');
    },

    adminUsers: function () {
      return request('/api/auth/users', 'GET');
    },

    adminDeleteUser: function (id) {
      return request('/api/auth/users/' + id, 'DELETE');
    },

    me: function () {
      if (!MEM.token) return Promise.resolve(null);
      return request('/api/auth/me', 'GET')
        .then(function (data) {
          if (data && data.user) {
            MEM.user = data.user;
            save();
          }
          return data.user || null;
        })
        .catch(function (err) {
          if (err && err.status === 401) clearSession();
          return null;
        });
    },

    clearSession: clearSession
  };
})(window);