package admin

import (
	"context"

	authv1 "service.xpcool.com/api/admin/v1/system/auth"
	"service.xpcool.com/internal/model/dto"
	"service.xpcool.com/internal/service/admin/system/auth"
)

// AuthController exposes only the public login endpoint.
type AuthController struct{}

// NewAuth creates the public admin auth controller (login only).
func NewAuth() *AuthController { return &AuthController{} }

// Login authenticates an administrator and issues a token pair.
func (c *AuthController) Login(ctx context.Context, req *authv1.LoginReq) (res *authv1.LoginRes, err error) {
	p, id, err := auth.AdminAuth().Login(ctx, dto.AdminLoginInput{Username: req.Username, Password: req.Password})
	if err != nil {
		return nil, err
	}
	return &authv1.LoginRes{AccessToken: p.AccessToken, RefreshToken: p.RefreshToken, ExpiresIn: p.ExpiresIn, AdminID: id}, nil
}

// Refresh rotates the administrator token pair using a valid refresh token.
func (c *AuthController) Refresh(ctx context.Context, req *authv1.RefreshReq) (res *authv1.RefreshRes, err error) {
	p, id, err := auth.AdminAuth().Refresh(ctx, req.RefreshToken)
	if err != nil {
		return nil, err
	}
	return &authv1.RefreshRes{AccessToken: p.AccessToken, RefreshToken: p.RefreshToken, ExpiresIn: p.ExpiresIn, AdminID: id}, nil
}

// Logout ends the administrator session. Stateless JWT logout relies on the
// client discarding tokens; the endpoint always succeeds for an authenticated admin.
func (c *AuthController) Logout(ctx context.Context, req *authv1.LogoutReq) (res *authv1.LogoutRes, err error) {
	return &authv1.LogoutRes{}, nil
}