/* Login Operatore: nome + PIN a 4 cifre (#59).
 * Componente Alpine globale `pinLogin()`, usato da templates/auth/login.html.
 * Contratto: GET /auth/pin-users -> [{id, display_name}];
 * POST /auth/login-pin {user_id, pin} -> {ok, redirect} | {error, detail}. */
function pinLogin() {
  return {
    mode: 'pin',        // vista Operatore di default; se l'elenco e' vuoto/fallisce passa a 'password'
    users: [],
    selected: null,
    pin: '',
    error: '',
    busy: false,

    init: function () {
      var self = this;
      fetch(window.TMF_PIN.usersUrl, { headers: { 'Accept': 'application/json' } })
        .then(function (r) { return r.ok ? r.json() : []; })
        .then(function (list) {
          self.users = Array.isArray(list) ? list : [];
          if (!self.users.length) self.mode = 'password';  // elenco vuoto: form password
        })
        .catch(function () { self.users = []; self.mode = 'password'; });
    },
    select: function (u) { this.selected = u; this.pin = ''; this.error = ''; },
    back: function () { this.selected = null; this.pin = ''; this.error = ''; },
    del: function () { this.pin = this.pin.slice(0, -1); },
    press: function (d) {
      if (this.busy || this.pin.length >= 4) return;
      this.pin += d;
      this.error = '';
      if (this.pin.length === 4) this.submit();  // invio automatico alla quarta cifra
    },
    submit: function () {
      var self = this;
      var csrf = document.querySelector('meta[name=csrf-token]');
      self.busy = true;
      fetch(window.TMF_PIN.loginUrl, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'Accept': 'application/json',
          'X-CSRFToken': (csrf && csrf.content) || ''
        },
        body: JSON.stringify({ user_id: self.selected.id, pin: self.pin })
      })
        .then(function (r) { return r.json().catch(function () { return {}; }); })
        .then(function (d) {
          if (d.ok && d.redirect) { window.location.href = d.redirect; return; }
          self.error = d.detail || window.TMF_PIN.msgNet;  // 401 PIN errato, 423 blocco con ora
          self.pin = '';
          self.busy = false;
        })
        .catch(function () {
          self.error = window.TMF_PIN.msgNet;
          self.pin = '';
          self.busy = false;
        });
    }
  };
}