'use client';
import { useCallback, useEffect, useState } from 'react';
import { cmsApi } from '../../lib/api.js';
/**
 * Drives the per-user MFA (TOTP) enrollment loop against the real auth API:
 *   1. `beginSetup(password)` — password reauth → POST /auth/totp/setup, which
 *      returns the provisioning URI + one-time backup codes.
 *   2. `confirmSetup(code)`   — POST /auth/totp/verify to flip totpEnabled on.
 *   3. `disable(password)`    — password reauth → POST /auth/totp/disable.
 *
 * The hook never holds the user's password and never persists the secret or
 * backup codes beyond the in-memory enrollment object (cleared on cancel/finish).
 */
export function useMfaEnrollment() {
    const [status, setStatus] = useState('loading');
    const [enrollment, setEnrollment] = useState(null);
    const [busy, setBusy] = useState(false);
    const refresh = useCallback(async () => {
        const res = await cmsApi('/auth/me');
        if (res.error || !res.data) {
            setStatus('error');
            return;
        }
        setStatus(res.data.totpEnabled ? 'enabled' : 'disabled');
    }, []);
    useEffect(() => {
        void refresh();
    }, [refresh]);
    const beginSetup = useCallback(async (password) => {
        if (!password)
            return { ok: false, error: 'Enter your current password to continue.' };
        setBusy(true);
        try {
            const res = await cmsApi('/auth/totp/setup', {
                method: 'POST',
                headers: { 'x-reauth-password': password },
                body: JSON.stringify({}),
            });
            if (res.error || !res.data) {
                return { ok: false, error: res.error ?? 'Could not start MFA setup.' };
            }
            setEnrollment(res.data);
            return { ok: true };
        }
        finally {
            setBusy(false);
        }
    }, []);
    const confirmSetup = useCallback(async (code) => {
        const trimmed = code.trim();
        if (!/^\d{6}$/.test(trimmed)) {
            return { ok: false, error: 'Enter the 6-digit code from your authenticator app.' };
        }
        setBusy(true);
        try {
            const res = await cmsApi('/auth/totp/verify', {
                method: 'POST',
                body: JSON.stringify({ code: trimmed }),
            });
            if (res.error)
                return { ok: false, error: res.error };
            setEnrollment(null);
            setStatus('enabled');
            return { ok: true };
        }
        finally {
            setBusy(false);
        }
    }, []);
    const cancelSetup = useCallback(() => {
        setEnrollment(null);
    }, []);
    const disable = useCallback(async (password) => {
        if (!password)
            return { ok: false, error: 'Enter your current password to continue.' };
        setBusy(true);
        try {
            const res = await cmsApi('/auth/totp/disable', {
                method: 'POST',
                headers: { 'x-reauth-password': password },
                body: JSON.stringify({}),
            });
            if (res.error)
                return { ok: false, error: res.error };
            setStatus('disabled');
            return { ok: true };
        }
        finally {
            setBusy(false);
        }
    }, []);
    return {
        status,
        enrollment,
        busy,
        refresh,
        beginSetup,
        confirmSetup,
        cancelSetup,
        disable,
    };
}
//# sourceMappingURL=useMfaEnrollment.js.map