//
// Token storage. Tokens live in the macOS Keychain, one entry per instance,
// keyed by the instance's base URL. Reads are memoised because the sidebar
// consults them on every render and each miss is a synchronous Keychain call.
//

const SERVICE = "unsupervised.giteanova";
const log = require("../util/log.js");

const cache = new Map();

function getToken(baseUrl) {
    if (!baseUrl) return null;
    if (cache.has(baseUrl)) return cache.get(baseUrl);

    let token = null;
    try {
        token = nova.credentials.getPassword(SERVICE, baseUrl);
    } catch (error) {
        log.error("keychain read failed", String(error));
    }
    cache.set(baseUrl, token);
    return token;
}

function setToken(baseUrl, token) {
    nova.credentials.setPassword(SERVICE, baseUrl, token);
    cache.set(baseUrl, token);
}

function removeToken(baseUrl) {
    try {
        nova.credentials.removePassword(SERVICE, baseUrl);
    } catch (error) {
        log.debug("keychain delete failed", String(error));
    }
    cache.delete(baseUrl);
}

function hasToken(baseUrl) {
    const token = getToken(baseUrl);
    return Boolean(token && token.length);
}

/** Forgets memoised tokens, so the next read goes back to the Keychain. */
function invalidate(baseUrl) {
    if (baseUrl) cache.delete(baseUrl);
    else cache.clear();
}

exports.SERVICE = SERVICE;
exports.getToken = getToken;
exports.setToken = setToken;
exports.removeToken = removeToken;
exports.hasToken = hasToken;
exports.invalidate = invalidate;