/**
 * Auth helpers — resolve stored OAuth credentials or OPENFERENCE_API_KEY.
 */

import { existsSync, readFileSync } from "node:fs";
import { homedir } from "node:os";
import { join } from "node:path";
import { API_KEY_ENV, OPENFERENCE_PROVIDER } from "./constants.ts";

const AUTH_FILE = join(homedir(), ".pi", "agent", "auth.json");

interface StoredCredential {
  type?: "api_key" | "oauth";
  access?: string;
  refresh?: string;
  expires?: number;
  key?: string;
}

export function resolveStartupApiKey(): string | undefined {
  return readStoredAccess() ?? process.env[API_KEY_ENV]?.trim();
}

export function readStoredCredential(): StoredCredential | undefined {
  try {
    if (!existsSync(AUTH_FILE)) return undefined;
    const raw = readFileSync(AUTH_FILE, "utf-8");
    const data = JSON.parse(raw) as Record<string, StoredCredential>;
    return data[OPENFERENCE_PROVIDER];
  } catch {
    return undefined;
  }
}

function readStoredAccess(): string | undefined {
  const cred = readStoredCredential();
  return cred?.access ?? cred?.key;
}

/** Far-future expiry for non-expiring API keys pasted via secondary login. */
export const FAR_FUTURE_EXPIRES = Date.now() + 10 * 365 * 24 * 60 * 60 * 1000;