//! Filesystem-backed `OAuthRepository` implementation.
//!
//! Tokens are stored as a single JSON file with write-then-rename + fsync
//! for crash safety, and restrictive owner-only mode `0o600` on Unix.

use std::path::Path;

use zesdex_domain::auth::{OAuthRepository, OAuthToken, RepositoryError};

use crate::utils::write_json_atomic;

/// Concrete filesystem OAuth token repository.
#[derive(Debug, Clone, Default)]
pub struct FileSystemOAuthRepository;

impl FileSystemOAuthRepository {
    pub fn new() -> Self {
        FileSystemOAuthRepository
    }
}

impl OAuthRepository for FileSystemOAuthRepository {
    fn save_token(&self, path: &Path, token: &OAuthToken) -> Result<(), RepositoryError> {
        if let Some(parent) = path.parent() {
            std::fs::create_dir_all(parent)?;
        }
        write_json_atomic(path, token, Some(0o600))?;
        Ok(())
    }

    fn load_token(&self, path: &Path) -> Result<Option<OAuthToken>, RepositoryError> {
        if !path.exists() {
            return Ok(None);
        }
        let data = std::fs::read_to_string(path)?;
        let token: OAuthToken = serde_json::from_str(&data)?;
        Ok(Some(token))
    }
}