package in.gsmx.finance

import java.net.HttpURLConnection
import java.net.URL
import org.json.JSONObject

/**
 * Minimal synchronous example for learning only. Call from Dispatchers.IO in a real UI.
 * Never disable TLS validation. Replace with Retrofit/OkHttp and structured error handling
 * before production.
 */
object ApiClient {
    fun postJson(path: String, payload: JSONObject, bearerToken: String? = null): Pair<Int, String> {
        require(BuildConfig.API_BASE_URL.startsWith("https://")) {
            "API_BASE_URL must use HTTPS outside local development"
        }
        val connection = (URL(BuildConfig.API_BASE_URL.trimEnd('/') + path).openConnection() as HttpURLConnection)
        connection.requestMethod = "POST"
        connection.connectTimeout = 10_000
        connection.readTimeout = 10_000
        connection.doOutput = true
        connection.setRequestProperty("Content-Type", "application/json; charset=utf-8")
        bearerToken?.let { connection.setRequestProperty("Authorization", "Bearer $it") }
        connection.outputStream.use { it.write(payload.toString().toByteArray(Charsets.UTF_8)) }
        val code = connection.responseCode
        val stream = if (code in 200..299) connection.inputStream else connection.errorStream
        val response = stream?.bufferedReader()?.use { it.readText() } ?: ""
        connection.disconnect()
        return code to response
    }
}