const SUPABASE_URL = 'https://hwithddwaapyhnfwcesj.supabase.co';
const SUPABASE_ANON_KEY = 'sb_publishable_fGXkh0bSrAOqSk2jWKAzSg_NJD9YPCv';
const ALLOWED_DOMAIN = '@craze.de';
const SESSION_KEY = 'craze_auth_session';

export interface AuthSession {
  access_token: string;
  user: { id: string; email: string };
}

export async function signIn(email: string, password: string): Promise<AuthSession> {
  if (!email.toLowerCase().endsWith(ALLOWED_DOMAIN)) {
    throw new Error(`Only ${ALLOWED_DOMAIN} email addresses are allowed.`);
  }

  const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=password`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'apikey': SUPABASE_ANON_KEY,
    },
    body: JSON.stringify({ email, password }),
  });

  if (!response.ok) {
    const err = await response.json().catch(() => ({}));
    throw new Error(err.error_description || err.message || 'Invalid email or password.');
  }

  const data = await response.json();
  const session: AuthSession = {
    access_token: data.access_token,
    user: { id: data.user.id, email: data.user.email },
  };

  localStorage.setItem(SESSION_KEY, JSON.stringify(session));
  return session;
}

export function signOut(): void {
  localStorage.removeItem(SESSION_KEY);
}

export function getStoredSession(): AuthSession | null {
  try {
    const raw = localStorage.getItem(SESSION_KEY);
    return raw ? (JSON.parse(raw) as AuthSession) : null;
  } catch {
    return null;
  }
}