SlipItIn/SlipItIn/Services/ApiService.cs

using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json;
using SlipItIn.Services.Interfaces;
using SlipItIn.Shared.DTOs;

namespace SlipItIn.Services;

public class ApiService : IApiService
{
    private readonly HttpClient _httpClient;
    private readonly IAppConfigurationService _configuration;
    private readonly IAuthSessionService _authSession;

    public ApiService(IAppConfigurationService configuration, IAuthSessionService authSession)
    {
        _configuration = configuration;
        _authSession = authSession;
        _httpClient = new HttpClient
        {
            BaseAddress = new Uri(_configuration.ApiBaseUrl)
        };
    }

    public Task<AuthResponseDto> RegisterAsync(RegisterRequestDto request, CancellationToken cancellationToken = default)
        => PostAuthAsync("api/auth/register", request, cancellationToken);

    public Task<AuthResponseDto> LoginAsync(LoginRequestDto request, CancellationToken cancellationToken = default)
        => PostAuthAsync("api/auth/login", request, cancellationToken);

    public async Task<SessionValidationResult> ValidateSessionAsync(CancellationToken cancellationToken = default)
    {
        if (string.IsNullOrWhiteSpace(_authSession.AccessToken))
            return SessionValidationResult.Invalid;

        try
        {
            AttachAuthHeader();
            var response = await _httpClient.GetAsync("api/auth/me", cancellationToken);
            return response.IsSuccessStatusCode
                ? SessionValidationResult.Valid
                : SessionValidationResult.Invalid;
        }
        catch (HttpRequestException)
        {
            return SessionValidationResult.NetworkError;
        }
        catch (TaskCanceledException)
        {
            return SessionValidationResult.NetworkError;
        }
    }

    public Task LogoutAsync() => _authSession.ClearSessionAsync();

    private async Task<AuthResponseDto> PostAuthAsync<TRequest>(string endpoint, TRequest request, CancellationToken cancellationToken)
    {
        AttachAuthHeader();

        var response = await _httpClient.PostAsJsonAsync(endpoint, request, cancellationToken);

        if (response.IsSuccessStatusCode)
        {
            var payload = await response.Content.ReadFromJsonAsync<AuthResponseDto>(cancellationToken: cancellationToken);
            if (payload is null)
                throw new InvalidOperationException("Leere Auth-Antwort vom Server.");

            return payload;
        }

        var message = await TryReadErrorMessageAsync(response, cancellationToken);
        throw new InvalidOperationException(message);
    }

    private void AttachAuthHeader()
    {
        var token = _authSession.AccessToken;
        _httpClient.DefaultRequestHeaders.Authorization = string.IsNullOrWhiteSpace(token)
            ? null
            : new AuthenticationHeaderValue("Bearer", token);
    }

    private static async Task<string> TryReadErrorMessageAsync(HttpResponseMessage response, CancellationToken cancellationToken)
    {
        var raw = await response.Content.ReadAsStringAsync(cancellationToken);
        if (string.IsNullOrWhiteSpace(raw))
            return $"Serverfehler ({(int)response.StatusCode}).";

        try
        {
            using var doc = JsonDocument.Parse(raw);
            if (doc.RootElement.ValueKind == JsonValueKind.Object &&
                doc.RootElement.TryGetProperty("message", out var msgElement))
            {
                var msg = msgElement.GetString();
                if (!string.IsNullOrWhiteSpace(msg))
                    return msg;
            }
        }
        catch
        {
            // ignore
        }

        return raw;
    }
}