Authentication

// Request
{
  "email": "user@example.com",
  "password": "securePassword123",
  "deviceId": "550e8400-e29b-41d4-a716-446655440000",
  "deviceInfo": {
    "platform": "ios",
    "model": "iPhone 15 Pro",
    "osVersion": "17.2",
    "appVersion": "1.0.0"
  }
}

// Response (200 OK)
{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 900, // 15 minutes
  "user": {
    "id": "usr_123456",
    "email": "user@example.com",
    "firstName": "Jean",
    "lastName": "Dupont",
    "kycLevel": 2,
    "roles": ["user"]
  }
}

import { apiClient } from './api';
import * as SecureStore from 'expo-secure-store';
import * as Device from 'expo-device';
import Constants from 'expo-constants';

interface LoginRequest {
  email: string;
  password: string;
  deviceId: string;
  deviceInfo: DeviceInfo;
}

interface AuthResponse {
  accessToken: string;
  refreshToken: string;
  expiresIn: number;
  user: User;
}

export const authService = {
  async login(email: string, password: string): Promise<AuthResponse> {
    // Récupère ou génère l'ID unique du device
    let deviceId = await SecureStore.getItemAsync('deviceId');
    if (!deviceId) {
      deviceId = crypto.randomUUID();
      await SecureStore.setItemAsync('deviceId', deviceId);
    }

    const deviceInfo = {
      platform: Device.osName?.toLowerCase() || 'unknown',
      model: Device.modelName || 'unknown',
      osVersion: Device.osVersion || 'unknown',
      appVersion: Constants.expoConfig?.version || '1.0.0',
    };

    const response = await apiClient.post<AuthResponse>('/auth/login', {
      email,
      password,
      deviceId,
      deviceInfo,
    });

    // Stocke les tokens de manière sécurisée
    await SecureStore.setItemAsync('accessToken', response.data.accessToken);
    await SecureStore.setItemAsync('refreshToken', response.data.refreshToken);

    // Stocke l'expiration pour le refresh proactif
    const expiresAt = Date.now() + response.data.expiresIn * 1000;
    await SecureStore.setItemAsync('tokenExpiresAt', expiresAt.toString());

    return response.data;
  },
};

// Request
{
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

// Response (200 OK)
{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 900
}

// Response (401 Unauthorized) - Token expiré ou invalide
{
  "error": "REFRESH_TOKEN_EXPIRED",
  "message": "Session expired. Please login again."
}

// Dans le store Zustand (authStore.ts)
import { create } from 'zustand';

interface AuthState {
  isAuthenticated: boolean;
  user: User | null;
  sessionExpiresAt: number | null;
  refreshSession: () => Promise<void>;
}

export const useAuthStore = create<AuthState>((set, get) => ({
  isAuthenticated: false,
  user: null,
  sessionExpiresAt: null,

  refreshSession: async () => {
    try {
      const refreshToken = await SecureStore.getItemAsync('refreshToken');
      if (!refreshToken) throw new Error('No refresh token');

      const response = await apiClient.post('/auth/refresh', { refreshToken });

      await SecureStore.setItemAsync('accessToken', response.data.accessToken);

      const expiresAt = Date.now() + response.data.expiresIn * 1000;
      await SecureStore.setItemAsync('tokenExpiresAt', expiresAt.toString());

      set({ sessionExpiresAt: expiresAt });
    } catch (error) {
      // Refresh failed - clear session
      await get().logout();
      throw error;
    }
  },
}));

// Hook pour refresh proactif
export function useTokenRefresh() {
  const { sessionExpiresAt, refreshSession } = useAuthStore();

  useEffect(() => {
    if (!sessionExpiresAt) return;

    // Refresh 5 minutes avant expiration
    const refreshTime = sessionExpiresAt - 5 * 60 * 1000;
    const delay = refreshTime - Date.now();

    if (delay > 0) {
      const timeout = setTimeout(refreshSession, delay);
      return () => clearTimeout(timeout);
    }
  }, [sessionExpiresAt, refreshSession]);
}

// Request - Enregistre la biométrie pour ce device
{
  "deviceId": "550e8400-e29b-41d4-a716-446655440000",
  "biometricType": "face_id", // ou "touch_id", "fingerprint"
  "biometricToken": "signed_device_attestation..."
}

// Response (200 OK)
{
  "success": true,
  "biometricEnabled": true,
  "message": "Biometric authentication enabled for this device"
}

import * as LocalAuthentication from 'expo-local-authentication';

export const biometricService = {
  // Vérifie si le device supporte la biométrie
  async isAvailable(): Promise<boolean> {
    const compatible = await LocalAuthentication.hasHardwareAsync();
    if (!compatible) return false;

    const enrolled = await LocalAuthentication.isEnrolledAsync();
    return enrolled;
  },

  // Récupère le type de biométrie disponible
  async getBiometricType(): Promise<'face_id' | 'touch_id' | 'fingerprint' | null> {
    const types = await LocalAuthentication.supportedAuthenticationTypesAsync();

    if (types.includes(LocalAuthentication.AuthenticationType.FACIAL_RECOGNITION)) {
      return 'face_id';
    }
    if (types.includes(LocalAuthentication.AuthenticationType.FINGERPRINT)) {
      return Platform.OS === 'ios' ? 'touch_id' : 'fingerprint';
    }
    return null;
  },

  // Authentification biométrique
  async authenticate(reason: string = 'Confirmer votre identité'): Promise<boolean> {
    try {
      const result = await LocalAuthentication.authenticateAsync({
        promptMessage: reason,
        cancelLabel: 'Annuler',
        disableDeviceFallback: false, // Permet PIN/password en fallback
      });

      return result.success;
    } catch (error) {
      console.error('Biometric auth failed:', error);
      return false;
    }
  },

  // Active la biométrie pour le compte
  async enableBiometric(): Promise<void> {
    const deviceId = await SecureStore.getItemAsync('deviceId');
    const biometricType = await this.getBiometricType();

    if (!biometricType) {
      throw new Error('Biometric not available on this device');
    }

    // Génère un token d'attestation device
    const biometricToken = await this.generateDeviceAttestation();

    await apiClient.post('/auth/biometric', {
      deviceId,
      biometricType,
      biometricToken,
    });

    await SecureStore.setItemAsync('biometricEnabled', 'true');
  },
};

// Response (200 OK)
{
  "devices": [
    {
      "id": "dev_123",
      "deviceId": "550e8400-e29b-41d4-a716-446655440000",
      "name": "iPhone 15 Pro",
      "platform": "ios",
      "lastActive": "2026-02-08T14:30:00Z",
      "biometricEnabled": true,
      "isCurrent": true
    },
    {
      "id": "dev_456",
      "deviceId": "660f9511-f30c-52e5-b827-557766551111",
      "name": "iPad Pro",
      "platform": "ios",
      "lastActive": "2026-02-07T10:15:00Z",
      "biometricEnabled": false,
      "isCurrent": false
    }
  ],
  "maxDevices": 5,
  "currentCount": 2
}

// Révoque la session d'un device spécifique
// Endpoint: DELETE /api/v1/mobile/user/devices/dev_456

// Response (200 OK)
{
  "success": true,
  "message": "Device session revoked"
}

// Note: Le device révoqué sera déconnecté au prochain appel API

export const authService = {
  async logout(): Promise<void> {
    try {
      // Notifie le backend pour invalider les tokens
      const deviceId = await SecureStore.getItemAsync('deviceId');
      await apiClient.post('/auth/logout', { deviceId });
    } catch (error) {
      // Continue même si l'appel API échoue
      console.warn('Logout API call failed:', error);
    } finally {
      // Nettoie TOUJOURS le stockage local
      await this.clearLocalSession();
    }
  },

  async clearLocalSession(): Promise<void> {
    // Supprime tous les tokens et données sensibles
    const keysToRemove = [
      'accessToken',
      'refreshToken',
      'tokenExpiresAt',
      'biometricEnabled',
      'userProfile',
      'walletCache',
    ];

    await Promise.all(
      keysToRemove.map(key => SecureStore.deleteItemAsync(key))
    );

    // Reset du store Zustand
    useAuthStore.getState().reset();

    // Nettoie le cache React Query
    queryClient.clear();
  },

  // Logout de tous les devices
  async logoutAllDevices(): Promise<void> {
    await apiClient.post('/auth/logout-all');
    await this.clearLocalSession();
  },
};