import Apis, { type AppResponseData_MeResp } from '@/shared/api'
import { ApiFailure, meKey, unwrapApi } from '@/shared/lib'
import { invalidateCache } from '@/shared/storage'

/** Identity behind `GET /me` — the same payload the workspace shell reads. */
export type SessionUser = NonNullable<AppResponseData_MeResp['data']>

/**
 * Session probe behind the auth routes' guest guard. Shares `meKey()` with the
 * workspace shell, so a signed-in visit redirects off an already cached
 * identity and the fresh copy warms the shell's own frame.
 */
export function fetchSessionUser(): Promise<SessionUser> {
  return unwrapApi<SessionUser>(Apis.account.me()).catch(err => {
    // A refused session must not stay cached: the guard redirects on a cached
    // identity, so a dead one would bounce the shell back to login forever.
    if (err instanceof ApiFailure && (err.code === 401 || err.code === 403)) {
      invalidateCache(meKey())
    }
    throw err
  })
}