thats-me/frontend/src/stores/auth.js

import { defineStore } from 'pinia'
import { computed, ref } from 'vue'
import { clearToken, loginRemote, logoutRemote, setToken } from 'src/services/apiClient'

export const AUTH_STORAGE_KEY = 'thatsme-auth'

export const LOCAL_DEMO_USER = {
  id: 'local-demo',
  email: 'demo@local',
  password: '',
  name: 'Demo',
  avatar: 'D',
  mode: 'local',
  seedDemoEvents: false
}

export const REMOTE_USERS = Array.from({ length: 6 }, (_, index) => {
  const number = index + 1
  return {
    id: `remote-user-${number}`,
    email: `user${number}@thats-me.app`,
    name: `User ${number}`,
    avatar: `U${number}`,
    mode: 'remote',
    seedDemoEvents: false
  }
})

function normalizeUser(user) {
  const mode = user.mode || 'local'

  return {
    id: String(user.id),
    email: String(user.email).trim().toLowerCase(),
    password: mode === 'local' ? '' : String(user.password || 'pass'),
    name: String(user.name || user.email),
    avatar: String(user.avatar || '?').slice(0, 3).toUpperCase(),
    mode,
    seedDemoEvents: false
  }
}

function normalizeRemoteUser(user) {
  return {
    id: String(user.id),
    email: String(user.email).trim().toLowerCase(),
    name: String(user.name || user.email),
    avatar: String(user.avatar || '?').slice(0, 3).toUpperCase(),
    mode: 'remote',
    seedDemoEvents: false
  }
}

export function getAvailableUsers() {
  return [normalizeUser(LOCAL_DEMO_USER), ...REMOTE_USERS]
}

function loadStoredAuth() {
  try {
    const stored = localStorage.getItem(AUTH_STORAGE_KEY)
    return stored ? JSON.parse(stored) : null
  } catch {
    return null
  }
}

export function hasStoredAuth() {
  const stored = loadStoredAuth()
  return Boolean(stored?.user || stored?.userId)
}

function persistAuth(user) {
  localStorage.setItem(AUTH_STORAGE_KEY, JSON.stringify({
    userId: user.id,
    mode: user.mode,
    user
  }))
}

export const useAuthStore = defineStore('auth', () => {
  const storedAuth = loadStoredAuth()
  const currentUserId = ref(storedAuth?.user?.id ?? storedAuth?.userId ?? null)
  const currentUserProfile = ref(storedAuth?.user ? normalizeUser(storedAuth.user) : null)
  const lastError = ref('')
  const users = ref(getAvailableUsers())

  const currentUser = computed(() =>
    currentUserProfile.value ?? users.value.find(user => user.id === currentUserId.value) ?? null
  )
  const isAuthenticated = computed(() => currentUser.value !== null)

  async function login(email, password) {
    const normalizedEmail = String(email).trim().toLowerCase()
    const user = users.value.find(candidate =>
      candidate.email === normalizedEmail
    )

    if (!user) {
      lastError.value = 'E-Mail oder Passwort ist falsch.'
      return false
    }

    if (user.mode === 'remote') {
      try {
        const data = await loginRemote(normalizedEmail, password)
        const remoteUser = normalizeRemoteUser(data.user)

        await setToken(data.token)
        currentUserId.value = remoteUser.id
        currentUserProfile.value = remoteUser
        lastError.value = ''
        persistAuth(remoteUser)

        return true
      } catch (error) {
        console.warn('Remote login failed:', error)
        lastError.value = error?.status === 422
          ? 'E-Mail oder Passwort ist falsch.'
          : 'Login über die API ist gerade nicht möglich.'
        return false
      }
    }

    if (user.mode === 'local') {
      currentUserId.value = user.id
      currentUserProfile.value = user
      lastError.value = ''
      persistAuth(user)
      return true
    }

    if (user.password !== password) {
      lastError.value = 'E-Mail oder Passwort ist falsch.'
      return false
    }

    currentUserId.value = user.id
    currentUserProfile.value = user
    lastError.value = ''
    persistAuth(user)
    return true
  }

  function logout() {
    if (currentUser.value?.mode === 'remote') {
      logoutRemote().catch(() => {})
    }

    currentUserId.value = null
    currentUserProfile.value = null
    lastError.value = ''
    localStorage.removeItem(AUTH_STORAGE_KEY)
    clearToken().catch(() => {})
  }

  return {
    users,
    currentUserId,
    currentUser,
    isAuthenticated,
    lastError,
    login,
    logout
  }
})