export type LoginResult = { ok: true } | { ok: false; reason: 'invalid-credentials' | 'network' };

/**
 * POSTs credentials to /api/v1/auth/login. On success the API sets an HttpOnly
 * session cookie in the response — we never see or handle the token itself, we
 * just let the browser store it (same-origin, so this works through Caddy in
 * production and through the dev proxy in vite.config.ts locally).
 */
export async function login(email: string, password: string): Promise<LoginResult> {
	try {
		const res = await fetch('/api/v1/auth/login', {
			method: 'POST',
			headers: { 'content-type': 'application/json' },
			credentials: 'include',
			body: JSON.stringify({ email, password })
		});
		if (res.ok) {
			return { ok: true };
		}
		if (res.status === 401) {
			return { ok: false, reason: 'invalid-credentials' };
		}
		return { ok: false, reason: 'network' };
	} catch {
		return { ok: false, reason: 'network' };
	}
}