import {createSessionCache, type SessionCache} from '$lib/sessionCache';

/**
 * Persists the destination ('new') password session of an in-progress migration in localStorage
 * so a page refresh can offer to resume it instead of forcing the user to re-enter the new
 * password and re-trigger 2FA. The source side is the user's OAuth session, which the OAuth client
 * persists itself (IndexedDB) and which the page restores by the DID stored in this entry.
 *
 * The key is versioned: v1 entries also held password JWTs for the old account and are ignored.
 *
 * Security note: this stores access + refresh JWTs in localStorage. Acceptable for this SPA,
 * mitigated by clearing on completion / start-over and by PasswordSession.resume() invalidating
 * dead sessions.
 */

const STORAGE_KEY = 'pdsmoover:migration-sessions:v2';

export type MigrationSessionCache = SessionCache<'new'>;

const cache = createSessionCache<'new'>(STORAGE_KEY, ['new']);

/** Persist (data) or drop (null) the destination session. */
export const saveSide = cache.saveSide;

/** Read the cached destination session, or null when there is nothing to resume. */
export const load = cache.load;

/** Remove the whole cache entry (completion / start-over / expired sessions). */
export const clear = cache.clear;