// supabase.jsx — auth layer. Override window.validateLogin agar pakai Supabase Auth.
// Non-breaking: bila window.SUPABASE_CONFIG belum diisi, validateLogin ASLI dipakai
// (fallback plaintext). Jadi app tetap jalan sebelum & sesudah migrasi.
//
// Konvensi: username "sma1" → email "sma1@idss.local" di Supabase Auth.
// Setelah auth sukses, ambil role/scope dari tabel idss.app_users.
(function () {
  const cfg = window.SUPABASE_CONFIG;
  const configured = cfg && cfg.url && cfg.anonKey && !cfg.url.includes("YOUR-PROJECT");

  // Simpan implementasi asli (plaintext) untuk fallback.
  const originalValidateLogin = window.validateLogin;

  if (!configured || !window.supabase) {
    // Belum dikonfigurasi / CDN gagal → biarkan plaintext. Tandai status.
    window.SB_ACTIVE = false;
    if (cfg && cfg.url && cfg.url.includes("YOUR-PROJECT"))
      console.info("[Supabase] Config placeholder — login pakai mode plaintext (demo).");
    return;
  }

  const sb = window.supabase.createClient(cfg.url, cfg.anonKey, {
    db: { schema: "idss" },
    auth: { persistSession: true, autoRefreshToken: true },
  });
  window.sb = sb;
  window.SB_ACTIVE = true;

  const emailFor = (username) => `${username}@idss.local`;

  // Override: Supabase Auth → lalu ambil profil dari app_users.
  window.validateLogin = async (username, password) => {
    if (!username || !password) return { valid: false, error: "Username dan password wajib diisi" };

    const rateCheck = window.LoginRateLimiter?.check(username);
    if (rateCheck && !rateCheck.allowed) return { valid: false, error: rateCheck.error };

    const { data, error } = await sb.auth.signInWithPassword({ email: emailFor(username), password });
    if (error) {
      window.LoginRateLimiter?.record(username, false);
      window.AuditLog?.log("login_bad_password", { username });
      const remaining = (rateCheck?.remainingAttempts || 5) - 1;
      return {
        valid: false,
        error: remaining > 0
          ? `Login gagal. ${remaining} percobaan tersisa sebelum dikunci 15 menit.`
          : "Login gagal. Login dikunci 15 menit.",
      };
    }

    // Ambil profil (role, nama, scope) dari app_users via auth_uid.
    const { data: prof, error: pErr } = await sb
      .from("app_users")
      .select("role, nama, sekolah_id, dapur_id, supplier_id")
      .eq("auth_uid", data.user.id)
      .maybeSingle();

    if (pErr || !prof) {
      await sb.auth.signOut();
      return { valid: false, error: "Akun terautentikasi tapi profil belum ditautkan (auth_uid). Hubungi admin." };
    }

    window.LoginRateLimiter?.record(username, true);
    window.AuditLog?.log("login_success", { username, role: prof.role });
    // Bentuk `user` SAMA seperti USER_ACCOUNTS agar login.jsx tak perlu diubah.
    return {
      valid: true,
      user: {
        role: prof.role,
        name: prof.nama || username,
        sekolahId: prof.sekolah_id || undefined,
        dapurId: prof.dapur_id || undefined,
        supplierId: prof.supplier_id || undefined,
      },
    };
  };

  // Dipanggil oleh logoutUser (app.jsx) — akhiri sesi Supabase juga.
  window.sbSignOut = async () => { try { await sb.auth.signOut(); } catch (e) { /* abaikan */ } };

  console.info("[Supabase] Auth aktif — login tervalidasi server-side + RLS.");
})();