import * as SecureStore from 'expo-secure-store';
import type { TokenStore } from 'parksmarter-client';

/**
 * A TokenStore backed by the OS keystore (expo-secure-store).
 *
 * On GrapheneOS/Android this uses the hardware-backed Keystore, so the user's
 * Auth_Token and SessionId are encrypted at rest — never plain AsyncStorage.
 */
const AUTH_KEY = 'ps_auth_token';
const SESSION_KEY = 'ps_session_id';

export const secureTokenStore: TokenStore = {
  getAuthToken: () => SecureStore.getItemAsync(AUTH_KEY),
  setAuthToken: (token) =>
    token
      ? SecureStore.setItemAsync(AUTH_KEY, token)
      : SecureStore.deleteItemAsync(AUTH_KEY),
  getSessionId: () => SecureStore.getItemAsync(SESSION_KEY),
  setSessionId: (id) =>
    id
      ? SecureStore.setItemAsync(SESSION_KEY, id)
      : SecureStore.deleteItemAsync(SESSION_KEY),
};
