// After createUserWithEmailAndPassword:
Future<void> signUpWithEmail(String email, String password) async {
  final credential = await _auth.createUserWithEmailAndPassword(
    email: email,
    password: password,
  );
  // Send verification email immediately
  await credential.user?.sendEmailVerification();
}

// Check verification status on app resume / profile load:
Future<bool> checkEmailVerified() async {
  await _auth.currentUser?.reload(); // Refresh from Firebase
  return _auth.currentUser?.emailVerified ?? false;
}

// Resend if user didn't receive it:
Future<void> resendVerificationEmail() async {
  await _auth.currentUser?.sendEmailVerification();
}

class FirebaseAuthSource {
  final FirebaseAuth _auth = FirebaseAuth.instance;

  // Google Sign-In
  Future<UserCredential> signInWithGoogle() async {
    final googleUser = await GoogleSignIn().signIn();
    if (googleUser == null) throw AuthCancelledException();

    final googleAuth = await googleUser.authentication;
    final credential = GoogleAuthProvider.credential(
      accessToken: googleAuth.accessToken,
      idToken: googleAuth.idToken,
    );

    return await _auth.signInWithCredential(credential);
  }

  // Email/Password
  Future<UserCredential> signUpWithEmail(String email, String password) async {
    return await _auth.createUserWithEmailAndPassword(
      email: email,
      password: password,
    );
  }

  // Apple Sign-In (required for iOS)
  Future<UserCredential> signInWithApple() async {
    final appleCredential = await SignInWithApple.getAppleIDCredential(
      scopes: [AppleIDAuthorizationScopes.email, AppleIDAuthorizationScopes.fullName],
    );

    final oauthCredential = OAuthProvider('apple.com').credential(
      idToken: appleCredential.identityToken,
      accessToken: appleCredential.authorizationCode,
    );

    return await _auth.signInWithCredential(oauthCredential);
  }

  // Sign out
  Future<void> signOut() async {
    await GoogleSignIn().signOut();
    await _auth.signOut();
  }

  // Auth state stream
  Stream<User?> get authStateChanges => _auth.authStateChanges();

  // Current user
  User? get currentUser => _auth.currentUser;

  // Get ID token for API calls
  Future<String?> getIdToken() async {
    return await _auth.currentUser?.getIdToken();
  }
}

class TokenManager {
  final FlutterSecureStorage _storage = const FlutterSecureStorage(
    aOptions: AndroidOptions(encryptedSharedPreferences: true),
    iOptions: IOSOptions(accessibility: KeychainAccessibility.first_unlock),
  );

  static const _accessTokenKey = 'ml_access_token';
  static const _refreshTokenKey = 'ml_refresh_token';

  Future<void> saveTokens({required String access, required String refresh}) async {
    await _storage.write(key: _accessTokenKey, value: access);
    await _storage.write(key: _refreshTokenKey, value: refresh);
  }

  Future<String?> getAccessToken() => _storage.read(key: _accessTokenKey);
  Future<String?> getRefreshToken() => _storage.read(key: _refreshTokenKey);

  Future<void> clearTokens() async {
    await _storage.delete(key: _accessTokenKey);
    await _storage.delete(key: _refreshTokenKey);
  }
}

class AuthInterceptor extends Interceptor {
  final TokenManager _tokenManager;
  final Dio _dio; // Separate Dio instance for token refresh

  AuthInterceptor(this._tokenManager, this._dio);

  @override
  void onRequest(RequestOptions options, RequestInterceptorHandler handler) async {
    final token = await _tokenManager.getAccessToken();
    if (token != null) {
      options.headers['Authorization'] = 'Bearer $token';
    }
    handler.next(options);
  }

  @override
  void onError(DioException err, ErrorInterceptorHandler handler) async {
    if (err.response?.statusCode == 401) {
      // Attempt token refresh
      final refreshToken = await _tokenManager.getRefreshToken();
      if (refreshToken != null) {
        try {
          final response = await _dio.post('/auth/refresh', data: {
            'refreshToken': refreshToken,
          });

          final newAccess = response.data['accessToken'];
          final newRefresh = response.data['refreshToken'];
          await _tokenManager.saveTokens(access: newAccess, refresh: newRefresh);

          // Retry original request with new token
          err.requestOptions.headers['Authorization'] = 'Bearer $newAccess';
          final retryResponse = await _dio.fetch(err.requestOptions);
          handler.resolve(retryResponse);
          return;
        } catch (_) {
          // Refresh failed → force logout
          await _tokenManager.clearTokens();
        }
      }
    }
    handler.next(err);
  }
}

class PrivacySettings {
  final bool showBettingStats;       // Show ROI on public profile
  final ProfileVisibility profileVisibility;  // public, friends, private
  final bool allowDiscovery;         // Appear in search results
  final bool shareActivityToFeed;    // Post actions to friend feed
}

// Must delete ALL user data across all services
Future<void> deleteAccount() async {
  final userId = currentUser.uid;

  // 1. Delete Firestore data
  await _deleteCollection('match_entries', userId);
  await _deleteCollection('bet_entries', userId);
  await _deleteCollection('follows', userId);
  // ... all collections

  // 2. Delete Storage files
  await _deleteStorageFolder('users/$userId');

  // 3. Delete Firebase Auth account
  await FirebaseAuth.instance.currentUser?.delete();

  // 4. Clear local data
  await AppDatabase.instance.deleteAllUserData(userId);
  await TokenManager().clearTokens();
}

// Validate invite codes before joining
Future<void> handleGroupInvite(String inviteCode) async {
  // 1. Sanitize input (alphanumeric only, 6 chars)
  if (!RegExp(r'^[A-Z0-9]{6}$').hasMatch(inviteCode.toUpperCase())) {
    throw InvalidInviteCodeException();
  }

  // 2. Verify group exists
  final group = await _groupRepo.findByInviteCode(inviteCode);
  if (group == null) throw GroupNotFoundException();

  // 3. Check membership limit (free tier: 5 members)
  if (group.memberCount >= _maxMembers) throw GroupFullException();

  // 4. Check if already a member
  final isMember = await _groupRepo.isMember(group.id, currentUser.id);
  if (isMember) throw AlreadyMemberException();

  // 5. Join group
  await _groupRepo.addMember(group.id, currentUser.id);
}

class RateLimiter {
  final Map<String, List<DateTime>> _requests = {};

  bool canMakeRequest(String endpoint, {int maxPerMinute = 30}) {
    final now = DateTime.now();
    final windowStart = now.subtract(const Duration(minutes: 1));

    _requests[endpoint] = (_requests[endpoint] ?? [])
        .where((t) => t.isAfter(windowStart))
        .toList();

    if (_requests[endpoint]!.length >= maxPerMinute) return false;

    _requests[endpoint]!.add(now);
    return true;
  }
}