#pragma once
#include <string>
#include <vector>
#include <windows.h>

#pragma comment(lib, "crypt32.lib")

/**
 * TokenStore — DPAPI-encrypted local storage for the refresh token.
 *
 * The refresh token is stored in %APPDATA%/skeet_loader/.session,
 * encrypted with CryptProtectData (DPAPI). This binds the data to:
 *   - Current Windows user account
 *   - Current machine hardware
 *
 * On a different machine or Windows user, DPAPI decryption will fail,
 * so the token naturally expires on machine/user change.
 *
 * Only the refresh_token is persisted. The access_token stays in memory only.
 */
class TokenStore
{
public:
    static TokenStore* Get();

    struct SessionData {
        std::string refreshToken;
        std::string username;
        bool valid = false;
    };

    /// Save refresh token + username to encrypted local file
    bool Save(const std::string& refreshToken, const std::string& username);

    /// Load and decrypt the stored session data
    SessionData Load();

    /// Delete the stored session file
    void Clear();

private:
    TokenStore() = default;
    ~TokenStore() = default;

    std::string GetStoragePath();
    std::vector<BYTE> Encrypt(const std::vector<BYTE>& plaintext);
    std::vector<BYTE> Decrypt(const std::vector<BYTE>& ciphertext);
};
