hyungi_document_server/Sources/DSKit/LiveDSClient.swift

import Foundation

/// Real-network DSClient (FU-A). Same DTOs/decoder as FixtureDSClient, so swapping it in is
/// behavior-identical except for I/O. URLSession with shared cookie storage so the HttpOnly refresh
/// cookie is replayed on `/auth/refresh`. A 401 on a bearer request triggers a single-flight refresh
/// + ONE retry (never on login/refresh/logout, to avoid loops).
///
/// Immutable stored props (URLSession/decoder shared but never mutated) → @unchecked Sendable.
public final class LiveDSClient: DSClient, @unchecked Sendable {
    private let base: DSBaseURL
    private let session: URLSession
    private let decoder: JSONDecoder
    private let encoder: JSONEncoder
    private let tokens: TokenProvider

    public init(base: DSBaseURL = .publicTLS, persistence: TokenPersistence = InMemoryTokenStore()) {
        let baseURL = base
        let config = URLSessionConfiguration.default
        config.httpCookieStorage = .shared
        config.httpShouldSetCookies = true
        let session = URLSession(configuration: config)
        let decoder = DSDecoder.make()

        self.base = baseURL
        self.session = session
        self.decoder = decoder
        self.encoder = DSEncoder.make()
        // Refresh closure captures only Sendable values (no self): raw POST /auth/refresh via cookie.
        self.tokens = TokenProvider(persistence: persistence) {
            var request = URLRequest(url: baseURL.url.appendingPathComponent("auth/refresh"))
            request.httpMethod = "POST"
            let (data, response) = try await session.data(for: request)
            guard let http = response as? HTTPURLResponse, http.statusCode == 200 else {
                throw DSError.unauthorized(message: "refresh failed")
            }
            return try decoder.decode(AccessTokenResponse.self, from: data).accessToken
        }
    }

    public func setAccessToken(_ token: String) async { await tokens.set(token) }

    // MARK: - Request building / sending

    private func makeRequest(_ endpoint: DSEndpoint, token: String?) throws -> URLRequest {
        // Build URL from the base string to preserve trailing slashes; URLComponents percent-encodes.
        let raw = base.url.absoluteString + "/" + endpoint.path
        guard var comps = URLComponents(string: raw) else {
            throw DSError.transport(underlying: "bad URL \(raw)")
        }
        if !endpoint.queryItems.isEmpty { comps.queryItems = endpoint.queryItems }
        guard let url = comps.url else { throw DSError.transport(underlying: "bad URL components") }

        var request = URLRequest(url: url)
        request.httpMethod = endpoint.method
        if endpoint.requiresBearer, let token { request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization") }
        if let body = try endpoint.httpBody(encoder) {
            request.httpBody = body
            request.setValue("application/json", forHTTPHeaderField: "Content-Type")
        }
        return request
    }

    private func perform(_ endpoint: DSEndpoint) async throws -> Data {
        let request = try makeRequest(endpoint, token: await tokens.current())
        let (data, response) = try await dataOrTransport(request)
        guard let http = response as? HTTPURLResponse else {
            throw DSError.transport(underlying: "no HTTP response")
        }
        if http.statusCode == 401, endpoint.requiresBearer {
            // Single-flight refresh + one retry.
            let newToken = try await tokens.refreshOnce()
            let retry = try makeRequest(endpoint, token: newToken)
            let (data2, response2) = try await dataOrTransport(retry)
            guard let http2 = response2 as? HTTPURLResponse else {
                throw DSError.transport(underlying: "no HTTP response")
            }
            guard (200..<300).contains(http2.statusCode) else { throw DSError.from(status: http2.statusCode, data: data2) }
            return data2
        }
        guard (200..<300).contains(http.statusCode) else { throw DSError.from(status: http.statusCode, data: data) }
        return data
    }

    private func dataOrTransport(_ request: URLRequest) async throws -> (Data, URLResponse) {
        do { return try await session.data(for: request) }
        catch { throw DSError.transport(underlying: "\(error)") }
    }

    private func send<T: Decodable>(_ endpoint: DSEndpoint, as type: T.Type) async throws -> T {
        let data = try await perform(endpoint)
        do { return try decoder.decode(T.self, from: data) }
        catch { throw DSError.decoding("\(endpoint.path): \(error)") }
    }

    private func sendVoid(_ endpoint: DSEndpoint) async throws { _ = try await perform(endpoint) }

    // MARK: - DSClient

    public func login(username: String, password: String, totpCode: String?) async throws -> AccessTokenResponse {
        let token: AccessTokenResponse = try await send(.login(username, password, totpCode), as: AccessTokenResponse.self)
        await tokens.set(token.accessToken)
        return token
    }
    public func me() async throws -> UserResponse { try await send(.me, as: UserResponse.self) }
    public func refresh() async throws -> AccessTokenResponse {
        let token: AccessTokenResponse = try await send(.refresh, as: AccessTokenResponse.self)
        await tokens.set(token.accessToken)
        return token
    }
    public func logout() async throws { try await sendVoid(.logout); await tokens.clear() }

    public func documents(_ query: DocumentListQuery) async throws -> DocumentListResponse { try await send(.documents(query), as: DocumentListResponse.self) }
    public func document(id: Int) async throws -> DocumentDetailResponse { try await send(.document(id), as: DocumentDetailResponse.self) }
    public func documentContent(id: Int) async throws -> DocumentContentResponse { try await send(.documentContent(id), as: DocumentContentResponse.self) }
    public func documentTree() async throws -> [DomainTreeNode] { try await send(.documentTree, as: [DomainTreeNode].self) }
    public func categoryCounts() async throws -> CategoryCounts { try await send(.categoryCounts, as: CategoryCounts.self) }
    public func duplicates() async throws -> DuplicatesResponse { try await send(.duplicates, as: DuplicatesResponse.self) }
    public func patchDocument(id: Int, _ update: DocumentUpdate) async throws -> DocumentResponse { try await send(.patchDocument(id, update), as: DocumentResponse.self) }
    public func putContent(id: Int, content: String) async throws { try await sendVoid(.putContent(id, content)) }
    public func deleteDocument(id: Int) async throws { try await sendVoid(.deleteDocument(id)) }

    public func search(q: String, mode: SearchMode?, page: Int?, debug: Bool?) async throws -> SearchResponse { try await send(.search(q, mode, page, debug), as: SearchResponse.self) }
    public func ask(q: String, limit: Int?, backend: String?, debug: Bool?) async throws -> AskResponse { try await send(.ask(q, limit, backend, debug), as: AskResponse.self) }

    public func memos(_ query: MemoListQuery) async throws -> MemoListResponse { try await send(.memos(query), as: MemoListResponse.self) }
    public func memo(id: Int) async throws -> MemoResponse { try await send(.memo(id), as: MemoResponse.self) }
    public func createMemo(_ create: MemoCreate) async throws -> MemoResponse { try await send(.createMemo(create), as: MemoResponse.self) }
    public func patchMemo(id: Int, _ update: MemoUpdate) async throws -> MemoResponse { try await send(.patchMemo(id, update), as: MemoResponse.self) }
    public func pinMemo(id: Int, pinned: Bool) async throws -> MemoResponse { try await send(.pinMemo(id, pinned), as: MemoResponse.self) }
    public func archiveMemo(id: Int, archived: Bool) async throws -> MemoResponse { try await send(.archiveMemo(id, archived), as: MemoResponse.self) }
    public func toggleMemoTask(id: Int, taskIndex: Int, checked: Bool) async throws -> MemoResponse { try await send(.toggleMemoTask(id, taskIndex, checked), as: MemoResponse.self) }
    public func deleteMemo(id: Int) async throws { try await sendVoid(.deleteMemo(id)) }

    public func digest(date: String?, country: String?) async throws -> DigestResponse { try await send(.digest(date, country), as: DigestResponse.self) }
}