import Foundation
import Security

enum KeychainStore {
    private static let service = "com.servdiary.mobile"
    private static let tokenAccount = "sanctum_token"
    private static let roleAccount = "team_role"

    static var token: String? {
        get { read(account: tokenAccount) }
        set {
            if let newValue {
                write(account: tokenAccount, value: newValue)
            } else {
                delete(account: tokenAccount)
            }
        }
    }

    static var teamRole: String? {
        get { read(account: roleAccount) }
        set {
            if let newValue {
                write(account: roleAccount, value: newValue)
            } else {
                delete(account: roleAccount)
            }
        }
    }

    static func clear() {
        token = nil
        teamRole = nil
    }

    private static func read(account: String) -> String? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne,
        ]
        var item: CFTypeRef?
        guard SecItemCopyMatching(query as CFDictionary, &item) == errSecSuccess,
              let data = item as? Data,
              let value = String(data: data, encoding: .utf8) else {
            return nil
        }
        return value
    }

    private static func write(account: String, value: String) {
        delete(account: account)
        let data = Data(value.utf8)
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecValueData as String: data,
        ]
        SecItemAdd(query as CFDictionary, nil)
    }

    private static func delete(account: String) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
        ]
        SecItemDelete(query as CFDictionary)
    }
}