/**
 * Client HTTP unique vers l'API StreakFit.
 * Auth = cookie de session Sanctum (credentials: 'include') + en-tête X-XSRF-TOKEN.
 * Le front ne stocke AUCUN token : tout est piloté par le back.
 */
function readCookie(name: string): string | null {
  if (import.meta.server) return null
  const m = document.cookie.match(new RegExp('(^|; )' + name + '=([^;]*)'))
  return m ? decodeURIComponent(m[2]!) : null
}

export function useApi() {
  const base = useRuntimeConfig().public.apiBase as string

  const api = $fetch.create({
    baseURL: base,
    credentials: 'include',
    headers: { Accept: 'application/json' },
    onRequest({ options }) {
      const xsrf = readCookie('XSRF-TOKEN')
      const headers = new Headers(options.headers as HeadersInit)
      if (xsrf) headers.set('X-XSRF-TOKEN', xsrf)
      options.headers = headers
    }
  })

  /** Pose le cookie XSRF avant toute requête mutante (login, register, POST…). */
  async function ensureCsrf() {
    await $fetch('/sanctum/csrf-cookie', { baseURL: base, credentials: 'include' })
  }

  return { api, ensureCsrf, base }
}