// Real login behind the approved access screen (30/10/2026). The role comes from the server, not from the
// role buttons; the original submit handlers still run afterwards, so the layout and navigation are unchanged.
const bridge=window.psiqAuthBridge,form=document.getElementById('login'),email=document.getElementById('email'),password=document.getElementById('password');
const submit=form.querySelector('button[type="submit"]');
let released=false;
email.value='';password.value='';email.autocomplete='username';password.autocomplete='current-password';

// A synthetic event skips the required-field check, which matters when a saved session enters with empty fields.
function enter(papel){bridge.setRole(papel);document.dispatchEvent(new CustomEvent('psiq:papel',{detail:papel}));released=true;try{form.dispatchEvent(new Event('submit',{bubbles:true,cancelable:true}))}finally{released=false}password.value=''}
function warn(field,message){field.setCustomValidity(message);field.reportValidity();field.addEventListener('input',()=>field.setCustomValidity(''),{once:true})}
async function post(url,body){return fetch(url,{method:'POST',headers:{'Content-Type':'application/json'},credentials:'same-origin',body:body&&JSON.stringify(body)})}

document.addEventListener('submit',async event=>{
 if(event.target!==form||released)return;
 event.preventDefault();event.stopImmediatePropagation();
 submit.disabled=true;
 try{
  const response=await post('/api/auth/entrar',{email:email.value.trim(),password:password.value}),data=await response.json().catch(()=>({}));
  if(response.ok)enter(data.papel);else warn(response.status===401?password:email,data.erro||'Não foi possível entrar agora.');
 }catch{warn(email,'Sem conexão com a plataforma. Tente de novo.')}
 finally{submit.disabled=false}
},true);

document.addEventListener('click',event=>{
 if(!event.target.closest('#logout,[data-admin-exit]'))return;
 post('/api/auth/sair').catch(()=>{});document.dispatchEvent(new CustomEvent('psiq:papel',{detail:null}));
 setTimeout(()=>{password.value=''},0);
},true);

fetch('/api/auth/eu',{credentials:'same-origin'}).then(r=>r.ok?r.json():null).then(user=>{if(user)enter(user.papel)}).catch(()=>{});

// Staff seeing the student area get a way back to the management panel, in the same corner as
// "Ver área do aluno". Students never get it: the role comes from the server.
const staff=['dev','admin','editor','financeiro'];
const back=document.createElement('button');
back.type='button';back.className='staff-switch';back.textContent='Voltar ao painel';back.hidden=true;
back.addEventListener('click',()=>bridge.openAdmin());
document.querySelector('#app .top-actions')?.prepend(back);
document.addEventListener('psiq:papel',event=>{back.hidden=!staff.includes(event.detail)});