import { apiFetch } from './client'

/**
 * POST /usr/login
 * Request:  { email, password }
 * Response: { token: string, user: { id, org_id, name, email, timezone, roles: string[], groups: string[] } }
 * Errors:   401 { error: "Invalid email or password" }
 */
export function login({ email, password }) {
  return apiFetch('/usr/login', {
    method: 'POST',
    auth: false,
    body: { email, password },
  })
}

/** Decode a JWT payload without verifying (only used to read `exp`). */
export function decodeJwt(token) {
  try {
    const [, payload] = token.split('.')
    const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'))
    return JSON.parse(json)
  } catch {
    return null
  }
}

/** True when the token has an `exp` claim in the past. */
export function isTokenExpired(token) {
  const payload = decodeJwt(token)
  if (!payload?.exp) return false
  return payload.exp * 1000 <= Date.now()
}