Auth Flow

import Foundation
import AuthenticationServices

/// Central authentication manager.
///
/// Coordinates Sign in with Apple, biometrics, and session management.
///
/// Usage:
/// ```swift
/// @main
/// struct MyApp: App {
///     @State private var authManager = AuthenticationManager()
///
///     var body: some Scene {
///         WindowGroup {
///             if authManager.isAuthenticated {
///                 ContentView()
///             } else {
///                 AuthenticationView()
///             }
///         }
///         .environment(authManager)
///     }
/// }
/// ```
@MainActor
@Observable
final class AuthenticationManager {

    // MARK: - Published State

    /// Whether user is currently authenticated.
    private(set) var isAuthenticated = false

    /// Current user info (if authenticated).
    private(set) var currentUser: AuthenticatedUser?

    /// Any authentication error.
    private(set) var error: AuthenticationError?

    /// Whether authentication is in progress.
    private(set) var isLoading = false

    // MARK: - Initialization

    init() {
        // Check for existing session on init
        Task {
            await checkExistingSession()
        }
    }

    // MARK: - Sign in with Apple

    /// Handle Sign in with Apple result.
    func handleSignInWithApple(_ result: Result<ASAuthorization, Error>) {
        isLoading = true
        defer { isLoading = false }

        switch result {
        case .success(let authorization):
            guard let credential = authorization.credential as? ASAuthorizationAppleIDCredential else {
                error = .invalidCredential
                return
            }

            // Extract user info
            let userID = credential.user

            // Name only on first sign-in - save immediately
            var name: String?
            if let fullName = credential.fullName {
                name = PersonNameComponentsFormatter().string(from: fullName)
            }

            // Email may be real or relay
            let email = credential.email

            // Save to Keychain
            saveCredentials(userID: userID, name: name, email: email)

            // Update state
            currentUser = AuthenticatedUser(
                id: userID,
                name: name ?? KeychainManager.shared.get(.userName),
                email: email ?? KeychainManager.shared.get(.userEmail)
            )
            isAuthenticated = true
            error = nil

        case .failure(let authError):
            if let asError = authError as? ASAuthorizationError {
                switch asError.code {
                case .canceled:
                    // User cancelled - not an error
                    break
                case .failed:
                    error = .failed(authError)
                case .invalidResponse:
                    error = .invalidCredential
                case .notHandled:
                    error = .failed(authError)
                case .unknown:
                    error = .unknown
                case .notInteractive:
                    error = .failed(authError)
                @unknown default:
                    error = .unknown
                }
            } else {
                error = .failed(authError)
            }
        }
    }

    // MARK: - Biometric Authentication

    /// Authenticate using Face ID or Touch ID.
    func authenticateWithBiometrics() async -> Bool {
        isLoading = true
        defer { isLoading = false }

        let success = await BiometricAuthManager.shared.authenticate()

        if success {
            // Load saved user
            if let userID = KeychainManager.shared.get(.userID) {
                currentUser = AuthenticatedUser(
                    id: userID,
                    name: KeychainManager.shared.get(.userName),
                    email: KeychainManager.shared.get(.userEmail)
                )
                isAuthenticated = true
            }
        }

        return success
    }

    // MARK: - Sign Out

    /// Sign out and clear all credentials.
    func signOut() {
        KeychainManager.shared.clearAll()
        currentUser = nil
        isAuthenticated = false
        error = nil
    }

    // MARK: - Credential State

    /// Check if existing credentials are still valid.
    func checkCredentialState() async {
        guard let userID = KeychainManager.shared.get(.userID) else {
            isAuthenticated = false
            return
        }

        let state = await SignInWithAppleManager.shared.checkCredentialState(userID: userID)

        switch state {
        case .authorized:
            // Still valid
            currentUser = AuthenticatedUser(
                id: userID,
                name: KeychainManager.shared.get(.userName),
                email: KeychainManager.shared.get(.userEmail)
            )
            isAuthenticated = true

        case .revoked, .notFound:
            // User revoked or doesn't exist
            signOut()

        case .transferred:
            // Handle account transfer if needed
            signOut()

        @unknown default:
            break
        }
    }

    // MARK: - Private

    private func checkExistingSession() async {
        guard KeychainManager.shared.get(.userID) != nil else {
            return
        }
        await checkCredentialState()
    }

    private func saveCredentials(userID: String, name: String?, email: String?) {
        KeychainManager.shared.save(userID, for: .userID)

        if let name = name {
            KeychainManager.shared.save(name, for: .userName)
        }

        if let email = email {
            KeychainManager.shared.save(email, for: .userEmail)
        }
    }
}

// MARK: - Models

/// Authenticated user information.
struct AuthenticatedUser: Sendable {
    let id: String
    let name: String?
    let email: String?
}

/// Authentication errors.
enum AuthenticationError: Error, LocalizedError {
    case invalidCredential
    case failed(Error)
    case cancelled
    case unknown

    var errorDescription: String? {
        switch self {
        case .invalidCredential:
            return "Invalid credentials received"
        case .failed(let error):
            return error.localizedDescription
        case .cancelled:
            return "Authentication was cancelled"
        case .unknown:
            return "An unknown error occurred"
        }
    }
}

import Foundation
import LocalAuthentication

/// Manager for biometric authentication (Face ID / Touch ID).
///
/// Usage:
/// ```swift
/// // Check availability
/// if BiometricAuthManager.shared.isAvailable {
///     let success = await BiometricAuthManager.shared.authenticate()
/// }
/// ```
final class BiometricAuthManager: Sendable {

    // MARK: - Singleton

    static let shared = BiometricAuthManager()

    private init() {}

    // MARK: - Properties

    /// Whether biometric authentication is available.
    var isAvailable: Bool {
        let context = LAContext()
        var error: NSError?
        return context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error)
    }

    /// The type of biometry available on this device.
    var biometryType: LABiometryType {
        let context = LAContext()
        _ = context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: nil)
        return context.biometryType
    }

    /// Human-readable name for the biometry type.
    var biometryName: String {
        switch biometryType {
        case .faceID:
            return "Face ID"
        case .touchID:
            return "Touch ID"
        case .opticID:
            return "Optic ID"
        case .none:
            return "Biometrics"
        @unknown default:
            return "Biometrics"
        }
    }

    /// SF Symbol name for the biometry type.
    var biometrySymbol: String {
        switch biometryType {
        case .faceID:
            return "faceid"
        case .touchID:
            return "touchid"
        case .opticID:
            return "opticid"
        case .none:
            return "lock"
        @unknown default:
            return "lock"
        }
    }

    // MARK: - Authentication

    /// Authenticate using biometrics.
    ///
    /// - Parameter reason: The reason shown to the user (default provided).
    /// - Returns: `true` if authentication succeeded.
    func authenticate(reason: String = "Sign in to your account") async -> Bool {
        let context = LAContext()

        // Allow fallback to device passcode
        context.localizedFallbackTitle = "Use Passcode"

        do {
            return try await context.evaluatePolicy(
                .deviceOwnerAuthenticationWithBiometrics,
                localizedReason: reason
            )
        } catch {
            return false
        }
    }

    /// Authenticate with detailed error information.
    ///
    /// - Parameter reason: The reason shown to the user.
    /// - Returns: Result with success or specific error.
    func authenticateWithResult(reason: String = "Sign in to your account") async -> Result<Void, BiometricError> {
        let context = LAContext()
        context.localizedFallbackTitle = "Use Passcode"

        var error: NSError?
        guard context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) else {
            return .failure(mapError(error))
        }

        do {
            let success = try await context.evaluatePolicy(
                .deviceOwnerAuthenticationWithBiometrics,
                localizedReason: reason
            )
            return success ? .success(()) : .failure(.authenticationFailed)
        } catch let laError as LAError {
            return .failure(mapLAError(laError))
        } catch {
            return .failure(.unknown)
        }
    }

    // MARK: - Error Mapping

    private func mapError(_ error: NSError?) -> BiometricError {
        guard let error = error else { return .unknown }

        switch error.code {
        case LAError.biometryNotAvailable.rawValue:
            return .notAvailable
        case LAError.biometryNotEnrolled.rawValue:
            return .notEnrolled
        case LAError.biometryLockout.rawValue:
            return .lockout
        default:
            return .unknown
        }
    }

    private func mapLAError(_ error: LAError) -> BiometricError {
        switch error.code {
        case .userCancel:
            return .cancelled
        case .userFallback:
            return .fallbackRequested
        case .authenticationFailed:
            return .authenticationFailed
        case .biometryLockout:
            return .lockout
        default:
            return .unknown
        }
    }
}

// MARK: - Errors

/// Biometric authentication errors.
enum BiometricError: Error, LocalizedError {
    case notAvailable
    case notEnrolled
    case lockout
    case cancelled
    case fallbackRequested
    case authenticationFailed
    case unknown

    var errorDescription: String? {
        switch self {
        case .notAvailable:
            return "Biometric authentication is not available on this device"
        case .notEnrolled:
            return "Please set up Face ID or Touch ID in Settings"
        case .lockout:
            return "Biometrics is locked. Please use your passcode."
        case .cancelled:
            return "Authentication was cancelled"
        case .fallbackRequested:
            return "User requested passcode entry"
        case .authenticationFailed:
            return "Authentication failed"
        case .unknown:
            return "An unknown error occurred"
        }
    }
}

import Foundation
import Security

/// Secure storage manager using Keychain.
///
/// Usage:
/// ```swift
/// // Save
/// KeychainManager.shared.save("value", for: .userID)
///
/// // Get
/// let value = KeychainManager.shared.get(.userID)
///
/// // Delete
/// KeychainManager.shared.delete(.userID)
/// ```
final class KeychainManager: Sendable {

    // MARK: - Singleton

    static let shared = KeychainManager()

    private init() {}

    // MARK: - Keys

    /// Keys for stored values.
    enum Key: String, Sendable {
        case userID = "com.app.auth.userID"
        case userName = "com.app.auth.userName"
        case userEmail = "com.app.auth.userEmail"
        case authToken = "com.app.auth.token"
        case refreshToken = "com.app.auth.refreshToken"
    }

    // MARK: - Save

    /// Save a string value to Keychain.
    @discardableResult
    func save(_ value: String, for key: Key) -> Bool {
        guard let data = value.data(using: .utf8) else {
            return false
        }

        // Delete existing
        delete(key)

        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key.rawValue,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
        ]

        let status = SecItemAdd(query as CFDictionary, nil)
        return status == errSecSuccess
    }

    /// Save data to Keychain.
    @discardableResult
    func save(_ data: Data, for key: Key) -> Bool {
        // Delete existing
        delete(key)

        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key.rawValue,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
        ]

        let status = SecItemAdd(query as CFDictionary, nil)
        return status == errSecSuccess
    }

    // MARK: - Get

    /// Get a string value from Keychain.
    func get(_ key: Key) -> String? {
        guard let data = getData(key) else {
            return nil
        }
        return String(data: data, encoding: .utf8)
    }

    /// Get data from Keychain.
    func getData(_ key: Key) -> Data? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key.rawValue,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]

        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)

        guard status == errSecSuccess else {
            return nil
        }

        return result as? Data
    }

    // MARK: - Delete

    /// Delete a value from Keychain.
    @discardableResult
    func delete(_ key: Key) -> Bool {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key.rawValue
        ]

        let status = SecItemDelete(query as CFDictionary)
        return status == errSecSuccess || status == errSecItemNotFound
    }

    /// Clear all stored values.
    func clearAll() {
        for key in [Key.userID, .userName, .userEmail, .authToken, .refreshToken] {
            delete(key)
        }
    }

    // MARK: - Exists

    /// Check if a key exists in Keychain.
    func exists(_ key: Key) -> Bool {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key.rawValue,
            kSecReturnData as String: false
        ]

        let status = SecItemCopyMatching(query as CFDictionary, nil)
        return status == errSecSuccess
    }
}

// MARK: - Codable Support

extension KeychainManager {

    /// Save an Encodable value to Keychain.
    func save<T: Encodable>(_ value: T, for key: Key) -> Bool {
        guard let data = try? JSONEncoder().encode(value) else {
            return false
        }
        return save(data, for: key)
    }

    /// Get a Decodable value from Keychain.
    func get<T: Decodable>(_ key: Key, as type: T.Type) -> T? {
        guard let data = getData(key) else {
            return nil
        }
        return try? JSONDecoder().decode(type, from: data)
    }
}

import SwiftUI
import AuthenticationServices

/// SwiftUI wrapper for Sign in with Apple button.
///
/// Usage:
/// ```swift
/// SignInWithAppleButtonView { result in
///     authManager.handleSignInWithApple(result)
/// }
/// ```
struct SignInWithAppleButtonView: View {

    let onCompletion: (Result<ASAuthorization, Error>) -> Void

    @State private var coordinator = SignInWithAppleCoordinator()

    var body: some View {
        SignInWithAppleButton(
            onRequest: { request in
                request.requestedScopes = [.fullName, .email]
            },
            onCompletion: onCompletion
        )
        .signInWithAppleButtonStyle(.black)
        .frame(height: 50)
        .cornerRadius(8)
    }
}

// MARK: - Custom Style Button

/// Custom styled Sign in with Apple button.
///
/// Use when you need more control over appearance.
struct CustomSignInWithAppleButton: View {

    let onTap: () -> Void

    @Environment(\.colorScheme) private var colorScheme

    var body: some View {
        Button(action: onTap) {
            HStack(spacing: 8) {
                Image(systemName: "apple.logo")
                    .font(.system(size: 18, weight: .semibold))

                Text("Sign in with Apple")
                    .font(.system(size: 17, weight: .semibold))
            }
            .foregroundColor(colorScheme == .dark ? .black : .white)
            .frame(maxWidth: .infinity)
            .frame(height: 50)
            .background(colorScheme == .dark ? Color.white : Color.black)
            .cornerRadius(8)
        }
        .buttonStyle(.plain)
    }
}

// MARK: - Continue with Apple Button

/// "Continue with Apple" variant.
struct ContinueWithAppleButton: View {

    let onCompletion: (Result<ASAuthorization, Error>) -> Void

    var body: some View {
        SignInWithAppleButton(
            .continue,
            onRequest: { request in
                request.requestedScopes = [.fullName, .email]
            },
            onCompletion: onCompletion
        )
        .signInWithAppleButtonStyle(.black)
        .frame(height: 50)
        .cornerRadius(8)
    }
}

// MARK: - Biometric Sign In Button

/// Button for biometric authentication.
struct BiometricSignInButton: View {

    let onAuthenticate: () async -> Void

    private let biometricManager = BiometricAuthManager.shared

    var body: some View {
        if biometricManager.isAvailable {
            Button {
                Task {
                    await onAuthenticate()
                }
            } label: {
                HStack(spacing: 8) {
                    Image(systemName: biometricManager.biometrySymbol)
                        .font(.system(size: 20))

                    Text("Sign in with \(biometricManager.biometryName)")
                        .font(.system(size: 17, weight: .semibold))
                }
                .foregroundColor(.white)
                .frame(maxWidth: .infinity)
                .frame(height: 50)
                .background(Color.accentColor)
                .cornerRadius(8)
            }
            .buttonStyle(.plain)
        }
    }
}

// MARK: - Previews

#Preview("Sign in with Apple") {
    VStack(spacing: 16) {
        SignInWithAppleButtonView { _ in }

        ContinueWithAppleButton { _ in }

        CustomSignInWithAppleButton { }

        BiometricSignInButton { }
    }
    .padding()
}

import Foundation
import AuthenticationServices

/// Manager for Sign in with Apple.
///
/// Handles credential requests and state checking.
final class SignInWithAppleManager: Sendable {

    // MARK: - Singleton

    static let shared = SignInWithAppleManager()

    private init() {}

    // MARK: - Credential State

    /// Check the current credential state for a user ID.
    func checkCredentialState(userID: String) async -> ASAuthorizationAppleIDProvider.CredentialState {
        await withCheckedContinuation { continuation in
            ASAuthorizationAppleIDProvider().getCredentialState(forUserID: userID) { state, _ in
                continuation.resume(returning: state)
            }
        }
    }

    // MARK: - Create Request

    /// Create an authorization request for Sign in with Apple.
    func createRequest() -> ASAuthorizationAppleIDRequest {
        let provider = ASAuthorizationAppleIDProvider()
        let request = provider.createRequest()
        request.requestedScopes = [.fullName, .email]
        return request
    }

    /// Create authorization requests including existing credentials.
    ///
    /// This allows seamless sign-in if user already has Apple ID credentials.
    func createRequests() -> [ASAuthorizationRequest] {
        let appleIDRequest = createRequest()

        // Also check for existing password credentials
        let passwordRequest = ASAuthorizationPasswordProvider().createRequest()

        return [appleIDRequest, passwordRequest]
    }
}

// MARK: - SwiftUI Coordinator

/// Coordinator for handling ASAuthorizationController delegate callbacks.
@MainActor
final class SignInWithAppleCoordinator: NSObject, ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {

    private var completion: ((Result<ASAuthorization, Error>) -> Void)?

    func signIn(completion: @escaping (Result<ASAuthorization, Error>) -> Void) {
        self.completion = completion

        let requests = SignInWithAppleManager.shared.createRequests()
        let controller = ASAuthorizationController(authorizationRequests: requests)
        controller.delegate = self
        controller.presentationContextProvider = self
        controller.performRequests()
    }

    // MARK: - ASAuthorizationControllerDelegate

    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
        completion?(.success(authorization))
        completion = nil
    }

    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
        completion?(.failure(error))
        completion = nil
    }

    // MARK: - ASAuthorizationControllerPresentationContextProviding

    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
        #if os(iOS)
        guard let scene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
              let window = scene.windows.first else {
            fatalError("No window found")
        }
        return window
        #elseif os(macOS)
        guard let window = NSApplication.shared.keyWindow else {
            fatalError("No window found")
        }
        return window
        #endif
    }
}