// Shared admin guard. Include in <head> of every admin page EXCEPT admin/index.html:
//   <script src="auth.js"></script>
// Page scripts should start with:  await PAS_ADMIN.ready;
//
// The page stays hidden until the server confirms the token. Real protection lives in the
// workers: even if someone skips this file, the endpoints reject requests without a valid token.

(function () {
    const AUTH_URL = "https://auth.dsouza-neil2011.workers.dev";
    const SUPPORT_URL = "https://pas-support.dsouza-neil2011.workers.dev";
    const TOKEN_KEY = "pasAdminToken";

    const token = sessionStorage.getItem(TOKEN_KEY);

    document.documentElement.style.visibility = "hidden";

    function kick() {
        sessionStorage.removeItem(TOKEN_KEY);
        window.location.replace("index.html");
        return new Promise(() => {}); // never resolves, page scripts never run
    }

    const PAS_ADMIN = {
        authUrl: AUTH_URL,
        supportUrl: SUPPORT_URL,
        token,

        headers() {
            return { "Content-Type": "application/json", "Authorization": `Bearer ${token}` };
        },

        logout() {
            sessionStorage.removeItem(TOKEN_KEY);
            window.location.href = "index.html";
        },

        async loadContent(key) {
            const res = await fetch(`${SUPPORT_URL}/content/${key}`);
            const data = await res.json();
            return data.success ? data.content : null;
        },

        async saveContent(key, content) {
            const res = await fetch(`${SUPPORT_URL}/content/${key}`, {
                method: "PUT",
                headers: this.headers(),
                body: JSON.stringify(content)
            });
            if (res.status === 401) return kick();
            const data = await res.json().catch(() => ({}));
            return res.ok && data.success;
        }
    };

    PAS_ADMIN.ready = (async () => {
        if (!token) return kick();
        try {
            const res = await fetch(`${AUTH_URL}/verify`, {
                method: "POST",
                headers: { "Authorization": `Bearer ${token}` }
            });
            if (!res.ok) return kick();
        } catch {
            return kick();
        }
        document.documentElement.style.visibility = "";
    })();

    window.PAS_ADMIN = PAS_ADMIN;
})();