const SERVICE = 'mintlify';
const ACCESS_TOKEN_ACCOUNT = 'access_token';
const REFRESH_TOKEN_ACCOUNT = 'refresh_token';
const USER_EMAIL_ACCOUNT = 'user_email';

export async function getKeytar(): Promise<typeof import('keytar')> {
  try {
    const mod = await import('keytar');
    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- ESM wraps CJS in { default: ... } at runtime despite types
    return mod.default ?? mod;
  } catch {
    throw new Error(
      'keytar is required for credential storage but is not installed. Install it with: npm install keytar'
    );
  }
}

export async function storeCredentials(
  accessToken: string,
  refreshToken: string,
  userEmail?: string | null
): Promise<void> {
  const keytar = await getKeytar();
  await Promise.all([
    keytar.setPassword(SERVICE, ACCESS_TOKEN_ACCOUNT, accessToken),
    keytar.setPassword(SERVICE, REFRESH_TOKEN_ACCOUNT, refreshToken),
  ]);

  try {
    if (userEmail === null) {
      await keytar.deletePassword(SERVICE, USER_EMAIL_ACCOUNT);
    } else if (userEmail !== undefined) {
      await keytar.setPassword(SERVICE, USER_EMAIL_ACCOUNT, userEmail);
    }
  } catch {}
}

export async function getAccessToken(): Promise<string | null> {
  const keytar = await getKeytar();
  return keytar.getPassword(SERVICE, ACCESS_TOKEN_ACCOUNT);
}

export async function getRefreshToken(): Promise<string | null> {
  const keytar = await getKeytar();
  return keytar.getPassword(SERVICE, REFRESH_TOKEN_ACCOUNT);
}

export async function getUserEmail(): Promise<string | null> {
  const keytar = await getKeytar();
  return keytar.getPassword(SERVICE, USER_EMAIL_ACCOUNT);
}

export async function storeUserEmail(userEmail: string): Promise<void> {
  const keytar = await getKeytar();
  await keytar.setPassword(SERVICE, USER_EMAIL_ACCOUNT, userEmail);
}

export async function clearCredentials(): Promise<void> {
  const keytar = await getKeytar();
  await Promise.all([
    keytar.deletePassword(SERVICE, ACCESS_TOKEN_ACCOUNT),
    keytar.deletePassword(SERVICE, REFRESH_TOKEN_ACCOUNT),
    keytar.deletePassword(SERVICE, USER_EMAIL_ACCOUNT).catch(() => false),
  ]);
}