// Shows a management toolbar + signed-in indicator on every page when the
// browser holds valid credentials. The public gallery is static and carries no
// markup for this; the bar is built here only after /api/session confirms the
// viewer is authenticated, so logged-out visitors see nothing and get no login
// dialog.
//
// A page may set <body data-slug="..."> (the photo pages do) to get an
// "Edit this" link straight to that post in /manage.
(function () {
  fetch("/api/session", { headers: { Accept: "application/json" }, cache: "no-store" })
    .then((r) => (r.ok ? r.json() : { authenticated: false }))
    .then((s) => {
      if (s && s.authenticated) buildBar();
    })
    .catch(() => {});

  function el(tag, cls, text) {
    const e = document.createElement(tag);
    if (cls) e.className = cls;
    if (text != null) e.textContent = text;
    return e;
  }

  function buildBar() {
    document.body.classList.add("authed");

    const bar = el("div", "session-bar");
    const path = location.pathname.replace(/\/$/, "");

    const link = (href, label) => {
      const a = el("a", null, label);
      a.href = href;
      bar.appendChild(a);
    };

    if (path !== "/upload") link("/upload", "Upload");
    if (path !== "/manage") link("/manage", "Manage");

    const slug = document.body.dataset.slug;
    if (slug) link("/manage?edit=" + encodeURIComponent(slug), "Edit this");

    bar.appendChild(el("span", "session-dot", "● signed in"));

    // Best-effort logout. HTTP Basic has no real sign-out — the browser caches
    // credentials and clears them reliably only when the window closes — so
    // this overwrites the cached credential with a throwaway one and reloads.
    // It works in some browsers and not others; a dependable logout would need
    // cookie sessions.
    const out = el("a", "session-out", "log out");
    out.href = "#";
    out.title = "Best-effort — HTTP Basic auth has no reliable logout";
    out.addEventListener("click", (e) => {
      e.preventDefault();
      fetch("/api/session", {
        headers: { Authorization: "Basic " + btoa("logout:" + Date.now()) },
        cache: "no-store",
      })
        .catch(() => {})
        .finally(() => setTimeout(() => location.reload(), 150));
    });
    bar.appendChild(out);

    document.body.appendChild(bar);
  }
})();