const ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';
const REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';
const EXPIRES_TIME_KEY = 'EXPIRES_TIME';
const LOGIN_FORM_KEY = 'LOGIN_FORM';

export function getAccessToken(): string | null {
  return localStorage.getItem(ACCESS_TOKEN_KEY) || sessionStorage.getItem(ACCESS_TOKEN_KEY);
}

export function getRefreshToken(): string | null {
  return localStorage.getItem(REFRESH_TOKEN_KEY) || sessionStorage.getItem(REFRESH_TOKEN_KEY);
}

export function getExpiresTime(): number | null {
  const val = localStorage.getItem(EXPIRES_TIME_KEY) || sessionStorage.getItem(EXPIRES_TIME_KEY);
  return val ? Number(val) : null;
}

export function setToken(accessToken: string, refreshToken: string, remember = true, expiresTime?: number) {
  const storage = remember ? localStorage : sessionStorage;
  storage.setItem(ACCESS_TOKEN_KEY, accessToken);
  storage.setItem(REFRESH_TOKEN_KEY, refreshToken);
  if (expiresTime) {
    storage.setItem(EXPIRES_TIME_KEY, String(expiresTime));
  }
}

export function removeToken() {
  localStorage.removeItem(ACCESS_TOKEN_KEY);
  localStorage.removeItem(REFRESH_TOKEN_KEY);
  localStorage.removeItem(EXPIRES_TIME_KEY);
  sessionStorage.removeItem(ACCESS_TOKEN_KEY);
  sessionStorage.removeItem(REFRESH_TOKEN_KEY);
  sessionStorage.removeItem(EXPIRES_TIME_KEY);
}

export interface LoginFormCache {
  username: string;
  password: string;
  rememberMe: boolean;
}

// Simple XOR obfuscation to avoid storing plaintext passwords in localStorage.
const OBFUSCATE_KEY = 0x5a;

function obfuscate(text: string): string {
  return Array.from(text)
    .map((c) => String.fromCharCode(c.charCodeAt(0) ^ OBFUSCATE_KEY))
    .map((c) => c.charCodeAt(0).toString(16).padStart(2, '0'))
    .join('');
}

function deobfuscate(hex: string): string {
  const bytes: number[] = [];
  for (let i = 0; i < hex.length; i += 2) {
    bytes.push(parseInt(hex.slice(i, i + 2), 16));
  }
  return String.fromCharCode(...bytes.map((b) => b ^ OBFUSCATE_KEY));
}

export function getLoginForm(): LoginFormCache | null {
  const raw = localStorage.getItem(LOGIN_FORM_KEY);
  if (raw) {
    try {
      const parsed = JSON.parse(raw) as { u: string; p: string; r: boolean };
      return {
        username: deobfuscate(parsed.u),
        password: deobfuscate(parsed.p),
        rememberMe: parsed.r,
      };
    } catch {
      return null;
    }
  }
  return null;
}

export function setLoginForm(form: LoginFormCache) {
  localStorage.setItem(
    LOGIN_FORM_KEY,
    JSON.stringify({
      u: obfuscate(form.username),
      p: obfuscate(form.password),
      r: form.rememberMe,
    }),
  );
}

export function removeLoginForm() {
  localStorage.removeItem(LOGIN_FORM_KEY);
}