import { useCallback, useEffect, useState, type ReactNode } from 'react'
import { authApi, type SessionPrincipal } from './auth'
import { AuthContext } from './useAuth'

// AuthProvider holds the validated session principal. On mount it asks GET /api/auth/session: a 200
// means an active MFA satisfied session (show the app), a 403 means none (show the login). refresh is
// called after a successful login or MFA step to flip the gate. The context object and the useAuth
// hook live in useAuth.ts so this file exports only a component (React Fast Refresh boundary).
export function AuthProvider({ children }: { children: ReactNode }) {
  const [principal, setPrincipal] = useState<SessionPrincipal | null>(null)
  const [loading, setLoading] = useState(true)

  const refresh = useCallback(async () => {
    try {
      setPrincipal(await authApi.session())
    } catch {
      setPrincipal(null)
    } finally {
      setLoading(false)
    }
  }, [])

  const logout = useCallback(async () => {
    try {
      await authApi.logout()
    } catch {
      // The cookie is cleared server side on success; on any error we still drop local state.
    }
    setPrincipal(null)
  }, [])

  useEffect(() => {
    void refresh()
  }, [refresh])

  return <AuthContext.Provider value={{ principal, loading, refresh, logout }}>{children}</AuthContext.Provider>
}