// API живёт на том же домене под /adept-api (напр. https://adept-online.space/adept-api).
// Относительный путь → тот же origin → без CORS и без mixed-content на HTTPS.
// Можно переопределить через NEXT_PUBLIC_API_URL в .env.local.
const API_BASE = (process.env.NEXT_PUBLIC_API_URL || "/adept-api").replace(/\/+$/, "");

export async function apiFetch<T = any>(
  path: string,
  options: RequestInit = {}
): Promise<T> {
  const token =
    typeof window !== "undefined" ? sessionStorage.getItem("adept_token") : null;

  const headers: HeadersInit = {
    "Content-Type": "application/json",
    Accept: "application/json",
    ...(options.headers || {}),
  };
  if (token) {
    (headers as Record<string, string>)["Authorization"] = `Bearer ${token}`;
  }

  let res: Response;
  try {
    res = await fetch(`${API_BASE}${path}`, { ...options, headers });
  } catch {
    throw new Error("Сеть / API недоступны");
  }

  const data = await res.json().catch(() => ({}));
  if (!res.ok) {
    if (res.status === 401 && typeof window !== "undefined") {
      sessionStorage.removeItem("adept_token");
    }
    throw new Error(data.error || `HTTP ${res.status}`);
  }
  return data as T;
}

export function setToken(token: string | null) {
  if (typeof window === "undefined") return;
  if (token) sessionStorage.setItem("adept_token", token);
  else sessionStorage.removeItem("adept_token");
}

export function getToken(): string | null {
  if (typeof window === "undefined") return null;
  return sessionStorage.getItem("adept_token");
}