package dev.ulfrx.recipe.auth

import com.russhwolf.settings.Settings

/**
 * Persists the opaque auth-state marker that signals "this install has logged in".
 *
 * The actual OIDC tokens (access, refresh, id) live in Lokksmith's own platform
 * storage (Keychain on iOS, encrypted store on Android). This class only persists
 * the literal marker constant ([LOKKSMITH_AUTH_STATE_MARKER]) so [AuthSession]
 * can decide whether to attempt a silent refresh on cold start. Because the value
 * is non-secret, plain key/value storage is sufficient.
 *
 * Platform [Settings] are wired in the platform Koin module:
 *  - Android: [com.russhwolf.settings.SharedPreferencesSettings]
 *  - iOS: [com.russhwolf.settings.KeychainSettings]
 */
class SecureAuthStateStore(
    private val settings: Settings,
) {
    fun read(): String? = settings.getStringOrNull(KEY)

    fun write(authStateJson: String) {
        settings.putString(KEY, authStateJson)
    }

    fun clear() {
        settings.remove(KEY)
    }

    private companion object {
        const val KEY = "auth_state_marker"
    }
}
