Auth Module

protocol AuthClient {
    func signInWithApple() async throws -> AuthUser
    func signInWithEmail(email: String, password: String) async throws -> AuthUser
    func signUpWithEmail(email: String, password: String) async throws -> AuthUser
    func resetPassword(email: String) async throws
    func signOut() async throws
    func currentUser() async -> AuthUser?
    func authStates() -> AsyncStream<AuthState>
}

// 1. Configure Supabase
let authConfig = AuthConfig(
    supabaseURL: URL(string: ProcessInfo.processInfo.environment["SUPABASE_URL"]!)!,
    supabaseAnonKey: ProcessInfo.processInfo.environment["SUPABASE_ANON_KEY"]!
)

// 2. Create HTTP client for Supabase API
let supabaseHTTPClient = Auth.SupabaseHTTPClient(
    baseURL: authConfig.supabaseURL,
    session: .shared
)

// 3. Create Apple Sign In coordinator
let appleSignInCoordinator = Auth.AppleSignInCoordinator()

// 4. Create SessionManager (production auth client)
let sessionManager = Auth.SessionManager(
    httpClient: supabaseHTTPClient,
    keychain: keychainStore,
    apple: appleSignInCoordinator,
    config: authConfig
)

// SessionManager automatically:
// - Loads saved session from Keychain on init
// - Schedules proactive token refresh (60s before expiry)
// - Emits auth state changes via AsyncStream
// - Handles all 3 providers (Apple, Google, Email)

// SessionManager handles:
// - Token refresh before expiry
// - Retry on refresh failure
// - Keychain persistence
// - Logout on refresh failure

// Observe auth state changes
for await state in authClient.authStates() {
    switch state {
    case .signedIn(let user):
        // Navigate to authenticated content
    case .signedOut:
        // Show sign-in screen
    }
}

// Add to AuthClient protocol
func signInWithGoogle() async throws -> AuthUser

// Implement in SupabaseAuthClient
func signInWithGoogle() async throws -> AuthUser {
    // Use Supabase's Google OAuth
    let session = try await supabase.auth.signIn(
        provider: .google
    )
    return AuthUser(from: session.user)
}

// Extend AuthUser
struct AuthUser {
    let id: String
    let email: String
    var displayName: String?
    var photoURL: URL?
    var customField: String?  // Add custom fields
}

// Feature flag controls it:
public static var shouldUseMock: Bool {
    #if DEBUG
    // AUTH_BYPASS env var can disable it
    return ProcessInfo.processInfo.environment["AUTH_BYPASS"] != "0"
    #else
    return false  // Never in RELEASE
    #endif
}