interface AccessTokenPayload {
  sub: number;        // 用户 ID
  role: UserRole;     // 角色
  tv: number;         // 签发时的 tokenVersion 快照
  type: "access";     // 令牌类型
  iat: number;        // 签发时间（Unix 秒）
  exp: number;        // 过期时间（Unix 秒）
}

// 推荐：内存变量
let accessToken: string | null = null;

// refreshToken 存 localStorage
function saveTokens(tokens: { accessToken: string; refreshToken: string }) {
  accessToken = tokens.accessToken;
  localStorage.setItem("refreshToken", tokens.refreshToken);
}

// 以 axios 为例
axios.interceptors.request.use((config) => {
  if (accessToken) {
    config.headers.Authorization = `Bearer ${accessToken}`;
  }
  return config;
});

let refreshPromise: Promise<string> | null = null;

axios.interceptors.response.use(
  (response) => response,
  async (error) => {
    const originalRequest = error.config;

    // 只拦截 401，且不是 refresh 自身或 login
    if (error.response?.status !== 401) throw error;
    if (originalRequest.url?.includes("/auth/refresh")) throw error;
    if (originalRequest.url?.includes("/auth/login")) throw error;

    // 防止并发刷新：多个请求同时 401 时，只发一次 refresh
    if (!refreshPromise) {
      refreshPromise = (async () => {
        try {
          const refreshToken = localStorage.getItem("refreshToken");
          if (!refreshToken) throw new Error("no refresh token");

          const { data } = await axios.post("/v1/auth/refresh", { refreshToken });
          accessToken = data.data.tokens.accessToken;
          localStorage.setItem("refreshToken", data.data.tokens.refreshToken);
          return data.data.tokens.accessToken;
        } catch {
          // 刷新失败 → 清除所有 token → 跳转登录
          accessToken = null;
          localStorage.removeItem("refreshToken");
          window.location.href = "/login";
          throw error;
        } finally {
          refreshPromise = null;
        }
      })();
    }

    // 等待刷新完成，拿到新 token 后重试
    const newToken = await refreshPromise;
    originalRequest.headers.Authorization = `Bearer ${newToken}`;
    return axios(originalRequest);
  },
);

async function login(account: string, password: string) {
  const { data } = await axios.post("/v1/auth/login", { account, password });
  const { accessToken, refreshToken } = data.data.tokens;
  saveTokens({ accessToken, refreshToken });
  // 获取当前用户
  const { data: me } = await axios.get("/v1/auth/me");
  return me.data;
}

async function logout() {
  const refreshToken = localStorage.getItem("refreshToken");
  if (refreshToken) {
    await axios.post("/v1/auth/logout", { refreshToken }).catch(() => {});
  }
  accessToken = null;
  localStorage.removeItem("refreshToken");
  window.location.href = "/login";
}

try {
  return await sendRequest<T>(path, options);
} catch (error) {
  if (error.status === 401 && options.auth !== false) {
    clearAuthTokens();     // ← 直接清 token
    redirectToLogin();     // ← 直接跳登录
  }
  throw error;
}

let refreshPromise: Promise<string> | null = null;

async function requestApi<T>(path: string, options: RequestOptions = {}): Promise<T> {
  try {
    return await sendRequest<T>(path, options);
  } catch (error) {
    if (!(error instanceof ApiClientError && error.status === 401 && options.auth !== false)) {
      throw error;
    }

    // 排除刷新接口自身和登录接口，避免死循环
    if (path.includes("/auth/refresh") || path.includes("/auth/login")) {
      throw error;
    }

    // 并发 401 排队：同一时刻只发一次 refresh
    if (!refreshPromise) {
      refreshPromise = doRefresh();
    }

    try {
      const newToken = await refreshPromise;
      // 用新 token 重试原请求
      return sendRequest<T>(path, { ...options, headers: { ...options.headers, Authorization: `Bearer ${newToken}` } });
    } catch {
      // 刷新也失败了 → 清 token → 跳登录
      clearAuthTokens();
      redirectToLogin();
      throw error;
    }
  }
}

async function doRefresh(): Promise<string> {
  try {
    const refreshToken = getRefreshToken();
    if (!refreshToken) throw new Error("no refresh token");
    const { data } = await sendRequest<{ tokens: { accessToken: string; refreshToken: string } }>(
      "/v1/auth/refresh",
      { method: "POST", body: { refreshToken }, auth: false },
    );
    setAccessToken(data.tokens.accessToken);
    setRefreshToken(data.tokens.refreshToken);
    return data.tokens.accessToken;
  } finally {
    refreshPromise = null; // 无论成功失败都释放锁
  }
}