const api = window.Addon.iframe();

// The SDK auto-refreshes the access token when apiGet/apiPost/... get a 401.
// Call refreshOAuthToken() yourself only when you need a fresh token up front —
// e.g. before a long batch of requests, or to hand a token off to another client.
const { access_token, expires_at } = await api.refreshOAuthToken();

// Inspect the token's lifetime or pass it down a call chain
// (web worker, your own backend, a third-party client, etc.).
console.log('Token valid until', new Date(expires_at));
sendTokenToWorker(access_token);

// Subsequent SDK calls automatically pick up the freshly refreshed token.
const cards = await api.apiGet('/api/v1/cards?limit=50');

// Returned by the SDK methods (authorizeOAuth / refreshOAuthToken / getOAuthAccessToken)
interface TokenResponse {
  access_token: string;
  expires_at: string; // ISO 8601
}

// getOAuthAccessToken() throws if the user has not authorized the addon yet —
// wrap it in try/catch instead of checking a flag.

const api = window.Addon.iframe();

async function ensureAuthorized() {
  try {
    // Resolves with { access_token, expires_at } if already authorized.
    await api.getOAuthAccessToken();
  } catch {
    // Throws when the user has not authorized the addon yet — start the flow.
    await api.authorizeOAuth();
  }
}

async function loadCurrentUser() {
  await ensureAuthorized();
  // api.apiGet attaches Authorization automatically
  // and refreshes the access token on 401.
  return api.apiGet('/api/v1/users/current');
}

GET /api/v1/addon-oauth/:addon_uid/tokens/:user_id/:company_id
Authorization: Bearer <addon_secret>

200 OK
{
  "has_token": true,
  "access_token": "eyJhbGciOiJSUzI1NiIsInR...",
  "expires_at": "2026-05-18T14:00:00Z"
}

POST /api/v1/addon-oauth/:addon_uid/tokens/:user_id/:company_id/refresh
Authorization: Bearer <addon_secret>

200 OK
{
  "has_token": true,
  "access_token": "eyJhbGciOiJSUzI1NiIsInR...",
  "expires_at": "2026-05-18T14:30:00Z"
}

// Inside the addon iframe.
// The SDK puts a JSON-encoded payload into window.location.hash; its
// "targetOrigin" field is the company URL (e.g. https://acme.kaiten.ru).
// Cache it once and forward to your backend with every request.
let cachedDomain;

export function getCompanyDomain() {
  if (cachedDomain !== undefined) return cachedDomain;

  const hash = decodeURIComponent(window.location.hash.replace(/^#/, ''));
  if (!hash) return (cachedDomain = '');

  try {
    const { targetOrigin } = JSON.parse(hash);
    if (!targetOrigin) return (cachedDomain = '');

    const host = new URL(targetOrigin).hostname;
    const baseHost = 'kaiten.ru'; // keep in sync with the backend's PUBLIC_API_BASE_HOST
    if (host === baseHost || host === 'localhost') return (cachedDomain = '');
    if (host.endsWith(`.${baseHost}`)) {
      return (cachedDomain = host.slice(0, -(baseHost.length + 1)));
    }
    return (cachedDomain = host.split('.')[0]);
  } catch {
    return (cachedDomain = '');
  }
}

// Forward the domain to your own backend with every request.
async function callAddonBackend(path, init = {}) {
  return fetch(`/api/addon-backend${path}`, {
    ...init,
    headers: {
      ...init.headers,
      'X-Kaiten-Domain': getCompanyDomain(),
    },
  });
}

// services/PublicApiService.js
// BASE_HOST is the root domain only — the company subdomain is appended per request.
// e.g. BASE_HOST = "kaiten.ru" -> built URL = "https://acme.kaiten.ru/api/v1/..."
const BASE_HOST = process.env.PUBLIC_API_BASE_HOST;
const ADDON_UID = process.env.ADDON_UID;
const ADDON_SECRET = process.env.ADDON_SECRET;

function buildApiUrl(domain) {
  // For local development BASE_HOST may already include localhost:port —
  // in that case skip the subdomain prefix.
  if (/^localhost(:|$)|^127\.0\.0\.1(:|$)/.test(BASE_HOST)) {
    return `http://${BASE_HOST}`;
  }
  if (!domain) {
    throw new Error('Company domain is required — pass it from the frontend (e.g. X-Kaiten-Domain header).');
  }
  return `https://${domain}.${BASE_HOST}`;
}

async function fetchUserToken(userId, companyId, domain) {
  const url = `${buildApiUrl(domain)}/api/v1/addon-oauth/${ADDON_UID}/tokens/${userId}/${companyId}`;
  const response = await fetch(url, {
    headers: { Authorization: `Bearer ${ADDON_SECRET}` },
  });

  if (!response.ok) {
    throw new Error(`Failed to get token: ${response.status}`);
  }

  const data = await response.json();
  if (!data.has_token) {
    throw new Error('User has not authorized this addon');
  }
  return {
    accessToken: data.access_token,
    expiresAt: new Date(data.expires_at),
    // Echo back the canonical domain — useful if you cache tokens per (user, company).
    domain: data.domain,
  };
}

async function refreshUserToken(userId, companyId, domain) {
  const url = `${buildApiUrl(domain)}/api/v1/addon-oauth/${ADDON_UID}/tokens/${userId}/${companyId}/refresh`;
  const response = await fetch(url, {
    method: 'POST',
    headers: { Authorization: `Bearer ${ADDON_SECRET}` },
  });
  if (!response.ok) throw new Error(`Refresh failed: ${response.status}`);
  const data = await response.json();
  return {
    accessToken: data.access_token,
    expiresAt: new Date(data.expires_at),
    domain: data.domain,
  };
}

module.exports = { fetchUserToken, refreshUserToken };

const tokenCache = new Map(); // key: `${userId}:${companyId}`

// Pass the company domain (see "Frontend: extract domain and forward it").
async function getUserToken(userId, companyId, domain) {
  const key = `${userId}:${companyId}`;
  const cached = tokenCache.get(key);
  const bufferMs = 5 * 60 * 1000; // 5 minutes

  if (cached && cached.expiresAt.getTime() - Date.now() > bufferMs) {
    return cached.accessToken;
  }

  // Reuse the canonical domain echoed by the previous response when available.
  const fresh = cached
    ? await refreshUserToken(userId, companyId, cached.domain || domain)
    : await fetchUserToken(userId, companyId, domain);

  tokenCache.set(key, fresh);
  return fresh.accessToken;
}

// Inside an addon iframe
const api = window.Addon.iframe();

// SDK adds Authorization: Bearer <access_token> automatically
// and refreshes the token on expiration.
const user = await api.apiGet('/api/v1/users/current');
// { id, email, full_name, avatar_url, ... }

const api = window.Addon.iframe();

const comment = await api.apiPost(
  `/api/v1/cards/${cardId}/comments`,
  { text: 'Hello from my addon!' },
);

// On the addon backend (Node.js)
const response = await fetch(`${API_URL}/api/v1/users/current`, {
  headers: {
    Authorization: `Bearer ${accessToken}`,
  },
});

if (!response.ok) {
  throw new Error(`API error ${response.status}`);
}

const user = await response.json();
// { id, email, full_name, avatar_url, ... }

// On the addon backend (Node.js)
const response = await fetch(`${API_URL}/api/v1/cards/${cardId}/comments`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${accessToken}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ text: 'Hello from my addon!' }),
});

if (!response.ok) {
  throw new Error(`Failed to post comment: ${response.status}`);
}

const comment = await response.json();

// buildApiUrl, tokenCache, getUserToken and refreshUserToken come from
// PublicApiService above. Pass the company domain through every call.
async function callApi(userId, companyId, domain, path, options = {}) {
  let token = await getUserToken(userId, companyId, domain);

  const makeRequest = (t) => fetch(`${buildApiUrl(domain)}${path}`, {
    ...options,
    headers: {
      ...options.headers,
      Authorization: `Bearer ${t}`,
    },
  });

  let response = await makeRequest(token);

  if (response.status === 401) {
    // Token may have been revoked or rotated mid-flight — refresh once and retry.
    const refreshed = await refreshUserToken(userId, companyId, domain);
    tokenCache.set(`${userId}:${companyId}`, refreshed);
    response = await makeRequest(refreshed.accessToken);
  }

  return response;
}