// CSP-safe post-swap navigation for server-emitted status partials.
//
// The login/registration/collection-delete htmx flows used to answer with an
// inline <script> that stashed the auth token and redirected. Hash-mode CSP
// (no 'unsafe-inline') refuses those scripts, so the server now emits plain
// data attributes instead and this module performs the navigation:
//
//   <div data-redirect="/dashboard" data-auth-token="…">Login successful!…</div>
//
// One delegated body listener covers every page (the main bundle loads
// everywhere htmx does), so no per-page wiring. Devices' token regeneration
// uses htmx's native HX-Refresh response header instead and needs nothing
// here.
//
// Note: only the token is stashed. The old script also wrote localStorage
// 'user'/'refreshToken', but nothing in web/src ever read them.

export function armAuthFormRedirects() {
  // htmx refuses to swap 4xx/5xx responses by default, which left the login
  // form silent on wrong passwords: the server's error partials (401 invalid
  // credentials, 429 lockout, 500s) never landed in the target div. Swap
  // them ourselves whenever the error response is an HTML partial — JSON
  // errors (API clients) are still ignored by htmx.
  document.body.addEventListener("htmx:beforeSwap", (event) => {
    const detail = (event as CustomEvent).detail as {
      xhr?: XMLHttpRequest;
      shouldSwap?: boolean;
      isError?: boolean;
    };
    const xhr = detail?.xhr;
    if (!xhr || xhr.status < 400) return;
    if (!(xhr.getResponseHeader("content-type") ?? "").includes("text/html")) return;
    detail.shouldSwap = true;
    detail.isError = false;
  });

  document.body.addEventListener("htmx:afterSwap", (event) => {
    const detail = (event as CustomEvent).detail as { target?: HTMLElement } | undefined;
    const el = detail?.target?.querySelector("[data-redirect]");
    if (!el) return;
    const token = el.getAttribute("data-auth-token");
    if (token) localStorage.setItem("token", token);
    window.location.href = el.getAttribute("data-redirect") ?? "/";
  });
}