/* ============================================================
   API client — talks to the Express backend
   ============================================================ */
async function api(path, opts = {}) {
  const { method = 'GET', body, formData } = opts;
  const init = { method, credentials: 'same-origin', headers: {} };
  if (formData) {
    init.body = formData;
  } else if (body !== undefined) {
    init.headers['Content-Type'] = 'application/json';
    init.body = JSON.stringify(body);
  }
  const res = await fetch(path, init);
  let data = null;
  try { data = await res.json(); } catch { /* non-JSON */ }
  if (!res.ok) {
    const err = new Error((data && data.error) || `Request failed (${res.status})`);
    err.status = res.status;
    throw err;
  }
  return data;
}

const API = {
  // auth
  login: (email, password) => api('/api/auth/login', { method: 'POST', body: { email, password } }),
  logout: () => api('/api/auth/logout', { method: 'POST' }),
  me: () => api('/api/auth/me'),
  changePassword: (currentPassword, newPassword) => api('/api/auth/change-password', { method: 'POST', body: { currentPassword, newPassword } }),
  // store
  catalog: () => api('/api/store/catalog'),
  placeOrder: (payload) => api('/api/orders', { method: 'POST', body: payload }),
  myOrders: () => api('/api/orders/mine'),
  // admin
  adminStats: () => api('/api/admin/stats'),
  adminUsers: () => api('/api/admin/users'),
  adminCreateUser: (u) => api('/api/admin/users', { method: 'POST', body: u }),
  adminUpdateUser: (id, u) => api(`/api/admin/users/${id}`, { method: 'PUT', body: u }),
  adminDeleteUser: (id) => api(`/api/admin/users/${id}`, { method: 'DELETE' }),
  adminAdjustCredits: (id, delta, note) => api(`/api/admin/users/${id}/credits`, { method: 'POST', body: { delta, note } }),
  adminOrders: () => api('/api/admin/orders'),
  adminOrder: (id) => api(`/api/admin/orders/${id}`),
  adminUpdateOrder: (id, body) => api(`/api/admin/orders/${id}`, { method: 'PUT', body }),
  adminProducts: () => api('/api/admin/products'),
  adminCreateProduct: (p) => api('/api/admin/products', { method: 'POST', body: p }),
  adminUpdateProduct: (id, p) => api(`/api/admin/products/${id}`, { method: 'PUT', body: p }),
  adminDeleteProduct: (id) => api(`/api/admin/products/${id}`, { method: 'DELETE' }),
  adminCreateVariant: (productId, v) => api(`/api/admin/products/${productId}/variants`, { method: 'POST', body: v }),
  adminUpdateVariant: (id, v) => api(`/api/admin/variants/${id}`, { method: 'PUT', body: v }),
  adminDeleteVariant: (id) => api(`/api/admin/variants/${id}`, { method: 'DELETE' }),
  adminUploadImage: (variantId, file, label) => {
    const fd = new FormData();
    fd.append('image', file);
    if (label) fd.append('label', label);
    return api(`/api/admin/variants/${variantId}/images`, { method: 'POST', formData: fd });
  },
  adminDeleteImage: (id) => api(`/api/admin/images/${id}`, { method: 'DELETE' }),
  adminApiKeys: () => api('/api/admin/api-keys'),
  adminCreateApiKey: (name) => api('/api/admin/api-keys', { method: 'POST', body: { name } }),
  adminRevokeApiKey: (id) => api(`/api/admin/api-keys/${id}`, { method: 'DELETE' }),
};

Object.assign(window, { api, API });