import { createQuery } from '@tanstack/svelte-query';
import { api } from './client';
import { qk } from './queries';

export type SystemPlaylistsStatus = {
  in_flight: boolean;
  last_run_at: string | null;
  last_error: string | null;
};

export async function getSystemPlaylistsStatus(): Promise<SystemPlaylistsStatus> {
  return api.get<SystemPlaylistsStatus>('/api/me/system-playlists-status');
}

// Refresh aggressively while a build is in_flight so the building → built
// transition appears live on the home page. Stale-time is short; manual
// invalidations on the server's POST endpoints are out of scope.
export function createSystemPlaylistsStatusQuery() {
  return createQuery({
    queryKey: qk.systemPlaylistsStatus(),
    queryFn: getSystemPlaylistsStatus,
    staleTime: 10_000
  });
}

// Self-service profile / password / API-token endpoints (U3) ---------------

export type MyProfile = {
  id: string;
  username: string;
  display_name: string | null;
  email: string | null;
  is_admin: boolean;
};

export type APITokenResponse = { api_token: string };

export async function changePassword(currentPassword: string, newPassword: string): Promise<void> {
  await api.put('/api/me/password', {
    current_password: currentPassword,
    new_password: newPassword,
  });
}

export async function updateProfile(input: { display_name?: string; email?: string }): Promise<MyProfile> {
  return api.put<MyProfile>('/api/me/profile', input);
}

export async function getAPIToken(): Promise<APITokenResponse> {
  return api.get<APITokenResponse>('/api/me/api-token');
}

export async function regenerateAPIToken(): Promise<APITokenResponse> {
  return api.post<APITokenResponse>('/api/me/api-token', {});
}

// Submits the browser's current IANA timezone for the authenticated
// user. Called from the auth store on login + bootstrap + once weekly
// (cadence tracked client-side in localStorage). Failures are
// non-fatal — the server's UTC fallback keeps the scheduler working
// until the next attempt.
export async function putMyTimezone(timezone: string): Promise<void> {
  await api.put<void>('/api/me/timezone', { timezone });
}

// Active sessions (#370) ---------------------------------------------------

// created_ip is frozen at issue time; last_ip moves with the session. The
// pair is the signal — the same device string arriving from an address you
// don't recognise is what a stolen token looks like from the inside.
export type ActiveSession = {
  id: string;
  user_agent: string;
  created_ip: string;
  last_ip: string;
  created_at: string;
  last_seen_at: string;
  current: boolean;
};

export async function listSessions(): Promise<ActiveSession[]> {
  return api.get<ActiveSession[]>('/api/me/sessions');
}

export async function revokeSession(id: string): Promise<void> {
  await api.del(`/api/me/sessions/${id}`);
}

// Returns how many were ended. The server excludes the caller's own session,
// so this never signs you out of the page you pressed it on.
export async function revokeOtherSessions(): Promise<number> {
  const body = await api.post<{ revoked: number }>('/api/me/sessions/logout-others', {});
  return body.revoked;
}
