// POS config — no PocketBase credentials here. The device only knows
// its own API key for this app's /api/v1/pos/* routes; PocketBase
// auth happens server-side (see src/lib/server/pocketbase-admin.ts).
window.POS_CONFIG = (function () {
  const STORAGE_KEY = "pos.apiKey";
  let apiKey = localStorage.getItem(STORAGE_KEY) || "";
  if (!apiKey && typeof window.prompt === "function") {
    // `prompt` is unsupported in some contexts (automated browsers,
    // headless test runners, some embedded webviews). Don't let a
    // missing prompt throw and abort the rest of the script — the
    // till will just have an empty key until the operator sets it via
    // the login flow / Settings page. The next attempt to call the
    // API will return 401, which the boot screens surface clearly.
    try {
      apiKey = window.prompt("Enter this till's POS API key (ask the office for it):") || "";
      if (apiKey) localStorage.setItem(STORAGE_KEY, apiKey);
    } catch (_) {
      apiKey = "";
    }
  }
  return { apiBase: "/api/v1/pos", apiKey };
})();

window.posFetch = async function (path, opts = {}) {
  const cfg = window.POS_CONFIG;
  const headers = Object.assign(
    { Authorization: "Bearer " + cfg.apiKey },
    opts.headers || {},
  );
  return fetch(cfg.apiBase + path, Object.assign({}, opts, { headers }));
};

// A wrong key is worth surfacing loudly — otherwise every screen just
// silently shows "Offline" and staff assume the network is down.
window.posClearApiKey = function () {
  localStorage.removeItem("pos.apiKey");
  location.reload();
};