// Axios wrapper: JWT bearer + AES envelope (auto encrypt/decrypt).
import axios from 'axios';
import { encrypt, decrypt, aesEnabled } from './aes.js';

const api = axios.create({ baseURL: '', timeout: 15000 });

api.interceptors.request.use(cfg => {
  const t = localStorage.getItem(cfg.baseURL?.includes('/admin') ? 'admin_token' : 'player_token');
  if (t) cfg.headers.Authorization = `Bearer ${t}`;
  if (cfg.data && aesEnabled) cfg.data = encrypt(cfg.data);
  return cfg;
});

api.interceptors.response.use(res => {
  if (aesEnabled && res.data) res.data = decrypt(res.data);
  return res;
}, err => {
  if (err.response?.status === 401) {
    localStorage.removeItem('admin_token');
    localStorage.removeItem('player_token');
    if (typeof window !== 'undefined') window.location.href = '/';
  }
  return Promise.reject(err);
});

export default api;