import { MemoryTokenStorage, type TokenStorage } from '@zyphr-dev/auth-core';

/**
 * Web token storage backed by `localStorage`, with a graceful in-memory fallback
 * when `localStorage` is unavailable (SSR, privacy modes, disabled storage).
 *
 * Note on security: `localStorage` is readable by any JS on the page, so it is
 * vulnerable to XSS token theft. For the strongest posture, proxy auth through
 * your own backend and keep the refresh token in an httpOnly cookie; use this
 * adapter for SPAs where that's not feasible, and pass a custom TokenStorage via
 * `ZyphrAuthProvider` if you have a better store.
 */
export function createWebStorage(): TokenStorage {
  const canUseLocalStorage = (() => {
    try {
      if (typeof globalThis === 'undefined') return false;
      const ls = (globalThis as { localStorage?: Storage }).localStorage;
      if (!ls) return false;
      const probe = '__zyphr_probe__';
      ls.setItem(probe, '1');
      ls.removeItem(probe);
      return true;
    } catch {
      return false;
    }
  })();

  if (!canUseLocalStorage) {
    return new MemoryTokenStorage();
  }

  const ls = (globalThis as unknown as { localStorage: Storage }).localStorage;
  return {
    getItem: (key) => ls.getItem(key),
    setItem: (key, value) => ls.setItem(key, value),
    removeItem: (key) => ls.removeItem(key),
  };
}