package auth

import (
	"errors"
	"os"
	"path/filepath"
	"strings"

	"github.com/zalando/go-keyring"
)

const service = "dots-cli"
const account = "token"

// ErrNoToken means no token is stored anywhere.
var ErrNoToken = errors.New("no token stored")

func tokenDir() string {
	if d := os.Getenv("DOTS_TOKEN_DIR"); d != "" {
		return d
	}
	home, _ := os.UserHomeDir()
	return filepath.Join(home, ".config", "dots")
}

func saveTokenFile(token string) error {
	dir := tokenDir()
	if err := os.MkdirAll(dir, 0o700); err != nil {
		return err
	}
	return os.WriteFile(filepath.Join(dir, "token"), []byte(token+"\n"), 0o600)
}

func loadTokenFile() (string, error) {
	b, err := os.ReadFile(filepath.Join(tokenDir(), "token"))
	if err != nil {
		return "", ErrNoToken
	}
	return strings.TrimSpace(string(b)), nil
}

// SaveToken prefers the OS keychain, falling back to a 0600 file.
func SaveToken(token string) error {
	if err := keyring.Set(service, account, token); err == nil {
		return nil
	}
	return saveTokenFile(token)
}

// LoadToken checks the keychain first, then the fallback file.
func LoadToken() (string, error) {
	if t, err := keyring.Get(service, account); err == nil && t != "" {
		return t, nil
	}
	return loadTokenFile()
}