import { NitroModules } from 'react-native-nitro-modules'
import type {
  GetTokensResponse,
  NitroGoogleSignin,
  OneTapAuthorizationResult,
  OneTapConfigureParams,
  OneTapResponse,
  OneTapSuccessData,
} from './specs/nitro-google-signin.nitro'

const hybrid =
  NitroModules.createHybridObject<NitroGoogleSignin>('NitroGoogleSignin')

/**
 * Universal (One Tap) Google Sign-In for React Native on iOS and Android.
 *
 * Call {@link configure} once before any other method.
 *
 * @see https://react-native-nitro-google-sign-in.github.io/docs/guide/usage
 */
export const GoogleOneTapSignIn = {
  /**
   * Configure Google Sign-In. Required before any other method.
   *
   * Set `offlineAccess: true` when your backend needs a `serverAuthCode`
   * (from sign-in success or `requestScopes()`). Without it, `serverAuthCode` is always `null`.
   */
  configure(params: OneTapConfigureParams): void {
    hybrid.configure(params)
  },

  /**
   * Validate Google Play Services on Android. Resolves immediately on iOS (no-op).
   *
   * @param showErrorResolutionDialog When `true` (default), show Google's resolution UI if Play Services can be updated.
   * @throws {@link GoogleSignInError} with `PLAY_SERVICES_NOT_AVAILABLE` on Android when unavailable.
   */
  checkPlayServices(showErrorResolutionDialog = true): Promise<void> {
    return hybrid.checkPlayServices(showErrorResolutionDialog)
  },

  /**
   * Low-friction sign-in without forcing the full account picker when possible.
   *
   * Android: Credential Manager with authorized accounts only.
   * iOS: current user or `restorePreviousSignIn()`.
   *
   * When `configure({ offlineAccess: true })`, **`serverAuthCode` is `null` on
   * this silent path on iOS** (and on Android until authorization completes).
   * Use {@link createAccount} or {@link presentExplicitSignIn} for the initial
   * offline-access grant that returns a `serverAuthCode`.
   *
   * User cancel is returned as `type: 'cancelled'`, not thrown.
   */
  signIn(): Promise<OneTapResponse> {
    return hybrid.signIn()
  },

  /**
   * Interactive sign-in that can show all Google accounts on the device.
   *
   * Android: Credential Manager, all accounts.
   * iOS: interactive `signIn(withPresenting:)`.
   */
  createAccount(): Promise<OneTapResponse> {
    return hybrid.createAccount()
  },

  /**
   * Explicit **Sign in with Google** UI.
   *
   * Android: `GetSignInWithGoogleOption` account dialog. When `hostedDomain` is
   * configured, the JWT `hd` claim is validated after sign-in (Credential Manager
   * flows apply the filter during the request).
   * iOS: same interactive flow as {@link createAccount}.
   */
  presentExplicitSignIn(): Promise<OneTapResponse> {
    return hybrid.presentExplicitSignIn()
  },

  /**
   * Request additional OAuth scopes after sign-in. User may see a consent screen.
   *
   * Requires an active signed-in session. Returns an `accessToken` for calling Google APIs
   * from the device. **`configure({ offlineAccess: true })` is required** for a non-null
   * `serverAuthCode` in the result (backend offline access).
   *
   * Works with both the imperative API and hooks such as `useGoogleSignInFromButton`
   * (sign in first via the hook / `signIn` / `createAccount`, then call `requestScopes`).
   *
   * @param scopes Full OAuth scope URLs (not short names).
   */
  requestScopes(scopes: string[]): Promise<OneTapAuthorizationResult> {
    return hybrid.requestScopes(scopes)
  },

  /**
   * Returns the currently signed-in user and granted scopes, or `null` if none.
   *
   * Synchronous. Use after sign-in (or on app launch) to inspect `scopes` before calling
   * {@link requestScopes} — e.g. only prompt existing users who have not consented to a
   * newly added Drive scope.
   *
   * **Android:** last Credential Manager session from encrypted storage.
   * **iOS:** `GIDSignIn.sharedInstance.currentUser` / `grantedScopes`.
   *
   * `serverAuthCode` is always `null` (one-time codes are not persisted).
   */
  getCurrentUser(): OneTapSuccessData | null {
    return hybrid.getCurrentUser()
  },

  /**
   * Returns the current user's ID and access tokens after sign-in.
   *
   * Use after a successful `signIn()`, `createAccount()`, or `presentExplicitSignIn()`.
   * Safe to call again later to refresh tokens without re-running the account picker
   * (iOS refreshes via `GIDSignIn`; Android uses `AuthorizationClient`).
   *
   * @throws {@link GoogleSignInError} with `SIGN_IN_REQUIRED` when no user is signed in.
   */
  getTokens(): Promise<GetTokensResponse> {
    return hybrid.getTokens()
  },

  /**
   * Clears a cached OAuth access token.
   *
   * Call when Google returns an error indicating the access token is invalid.
   * Android removes the token from `AuthorizationClient`'s local cache.
   * iOS marks the AppAuth session for refresh so the next `getTokens()` fetches
   * a new access token from Google.
   */
  clearCachedAccessToken(accessTokenString: string): Promise<void> {
    return hybrid.clearCachedAccessToken(accessTokenString)
  },

  /** Clear the Google Sign-In session in the native SDK. */
  signOut(): Promise<void> {
    return hybrid.signOut()
  },

  /**
   * Revoke app access / OAuth grant for the user.
   *
   * **Android:** resolves the account from `emailOrUniqueId` (email or
   * `OneTapUser.id`).
   *
   * **iOS:** only revokes the **current signed-in session**; throws if
   * `emailOrUniqueId` does not match the active user. Call {@link signIn} first
   * when revoking a specific stored account.
   *
   * @param emailOrUniqueId User email or stable Google account id (`OneTapUser.id`).
   */
  revokeAccess(emailOrUniqueId: string): Promise<void> {
    return hybrid.revokeAccess(emailOrUniqueId)
  },
}