Authentication and Session Management

sealed class AuthState {
  const AuthState();
}

/// Reading stored credentials on launch — show a splash, not a login form
final class AuthUnknown extends AuthState {
  const AuthUnknown();
}

final class Authenticated extends AuthState {
  const Authenticated(this.user);
  final User user;
}

final class Unauthenticated extends AuthState {
  const Unauthenticated({this.reason});
  /// e.g. 'Your session expired' — worth telling the user
  final String? reason;
}

import 'package:flutter_secure_storage/flutter_secure_storage.dart';

class TokenStore {
  static const _storage = FlutterSecureStorage(
    aOptions: AndroidOptions(encryptedSharedPreferences: true),
    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
  );

  static const _accessKey = 'access_token';
  static const _refreshKey = 'refresh_token';

  Future<void> save({required String access, required String refresh}) async {
    await Future.wait([
      _storage.write(key: _accessKey, value: access),
      _storage.write(key: _refreshKey, value: refresh),
    ]);
  }

  Future<String?> get accessToken => _storage.read(key: _accessKey);
  Future<String?> get refreshToken => _storage.read(key: _refreshKey);

  Future<void> clear() => _storage.deleteAll();
}

class AuthController extends ChangeNotifier {
  AuthController({required this.api, required this.tokens});

  final AuthApi api;
  final TokenStore tokens;

  AuthState _state = const AuthUnknown();
  AuthState get state => _state;
  bool get isLoggedIn => _state is Authenticated;

  void _set(AuthState next) {
    _state = next;
    notifyListeners();
  }

  /// Called once at startup, before the first screen is shown.
  Future<void> restore() async {
    final token = await tokens.accessToken;
    if (token == null) {
      _set(const Unauthenticated());
      return;
    }

    try {
      final user = await api.me();
      _set(Authenticated(user));
    } on ApiException catch (e) {
      if (e.statusCode == 401) {
        await tokens.clear();
        _set(const Unauthenticated(reason: 'Your session expired'));
      } else {
        // Offline: trust the stored token rather than logging the user out
        _set(Authenticated(await _cachedUser()));
      }
    }
  }

  Future<void> signIn(String email, String password) async {
    final result = await api.signIn(email: email, password: password);
    await tokens.save(access: result.accessToken, refresh: result.refreshToken);
    _set(Authenticated(result.user));
  }

  Future<void> signOut() async {
    // Revoke server-side first, but never let a failure trap the user
    try {
      await api.signOut();
    } catch (_) {}
    await tokens.clear();
    _set(const Unauthenticated());
  }
}

class AuthInterceptor extends Interceptor {
  AuthInterceptor(this.tokens, this.dio, this.onSessionExpired);

  final TokenStore tokens;
  final Dio dio;
  final VoidCallback onSessionExpired;

  // Ensures ten parallel 401s trigger one refresh, not ten
  Future<String?>? _refreshFuture;

  @override
  Future<void> onRequest(options, handler) async {
    final token = await tokens.accessToken;
    if (token != null) {
      options.headers['Authorization'] = 'Bearer $token';
    }
    handler.next(options);
  }

  @override
  Future<void> onError(DioException error, handler) async {
    if (error.response?.statusCode != 401) {
      return handler.next(error);
    }

    final newToken = await (_refreshFuture ??= _refresh());
    _refreshFuture = null;

    if (newToken == null) {
      onSessionExpired();
      return handler.next(error);
    }

    // Replay the original request with the fresh token
    final request = error.requestOptions;
    request.headers['Authorization'] = 'Bearer $newToken';
    try {
      handler.resolve(await dio.fetch(request));
    } on DioException catch (e) {
      handler.next(e);
    }
  }

  Future<String?> _refresh() async {
    final refresh = await tokens.refreshToken;
    if (refresh == null) return null;
    try {
      final result = await AuthApi.rawRefresh(refresh);
      await tokens.save(
        access: result.accessToken,
        refresh: result.refreshToken,
      );
      return result.accessToken;
    } catch (_) {
      await tokens.clear();
      return null;
    }
  }
}

// With go_router, auth is a redirect, not a per-screen check
final router = GoRouter(
  refreshListenable: authController,
  redirect: (context, state) {
    final auth = authController.state;

    // Still restoring — hold on the splash route
    if (auth is AuthUnknown) return '/splash';

    final loggedIn = auth is Authenticated;
    final atAuthScreen = state.matchedLocation == '/login' ||
        state.matchedLocation == '/splash';

    if (!loggedIn && !atAuthScreen) return '/login';
    if (loggedIn && atAuthScreen) return '/';
    return null;
  },
  routes: [/* ... */],
);

import 'package:local_auth/local_auth.dart';

Future<bool> unlockWithBiometrics() async {
  final auth = LocalAuthentication();

  if (!await auth.canCheckBiometrics || !await auth.isDeviceSupported()) {
    return false;   // fall back to password
  }

  try {
    return await auth.authenticate(
      localizedReason: 'Unlock FlutterLearn',
      options: const AuthenticationOptions(
        stickyAuth: true,      // survives backgrounding mid-prompt
        biometricOnly: false,  // allow device PIN as a fallback
      ),
    );
  } on PlatformException {
    return false;
  }
}