"""Local storage for diora server credentials used by `diora-tui sync`.

Mirrors the trust model of the web client's key storage (static/js/app.js,
getOrCreateEncKey/exportEncKey): the raw AES-256 key and API token are kept
in plaintext on disk, scoped to this machine/user (0600), with no additional
at-rest encryption — same exposure as the browser's localStorage already has.
"""

from __future__ import annotations

import json
import stat
from dataclasses import asdict, dataclass
from pathlib import Path

from platformdirs import user_config_dir

_CONFIG_DIR = Path(user_config_dir("diora-tui", "diora"))
_CONFIG_FILE = _CONFIG_DIR / "config.json"


@dataclass
class RemoteConfig:
    server_url: str
    api_token: str
    enc_key_b64: str


def load() -> RemoteConfig | None:
    if not _CONFIG_FILE.exists():
        return None
    try:
        data = json.loads(_CONFIG_FILE.read_text())
        return RemoteConfig(**data)
    except (json.JSONDecodeError, OSError, TypeError):
        return None


def save(cfg: RemoteConfig) -> None:
    _CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    _CONFIG_FILE.write_text(json.dumps(asdict(cfg), indent=2))
    _CONFIG_FILE.chmod(stat.S_IRUSR | stat.S_IWUSR)