Authentication

import { auth } from '@/lib/lubes'

// Sign up with email and password
const { user, session, error } = await auth.signUp({
  email: 'user@example.com',
  password: 'secure-password-123',
  metadata: {
    name: 'John Doe',
    avatar_url: 'https://example.com/avatar.png',
  },
})

if (error) {
  console.error('Sign up failed:', error.message)
  return
}

console.log('Welcome!', user.email)

// Sign in with email and password
const { user, session, error } = await auth.signIn({
  email: 'user@example.com',
  password: 'secure-password-123',
})

if (error) {
  if (error.code === 'invalid_credentials') {
    console.error('Wrong email or password')
  }
  return
}

// Session tokens are automatically stored
console.log('Signed in as:', user.email)

// Request password reset email
await auth.resetPasswordForEmail('user@example.com', {
  redirectTo: 'https://myapp.com/reset-password',
})

// User clicks link in email, then:
await auth.updatePassword('new-secure-password-456')

// Redirect to OAuth provider
await auth.signInWithOAuth({
  provider: 'github',
  redirectTo: 'https://myapp.com/auth/callback',
  scopes: ['user:email'], // Optional additional scopes
})

// In your callback page, the session is automatically set
// Just redirect to your app
const { user, session } = await auth.getSession()

// User must be signed in first
await auth.linkOAuthAccount({
  provider: 'google',
  redirectTo: 'https://myapp.com/settings/accounts',
})

// List linked accounts
const accounts = await auth.getLinkedAccounts()
// [{ provider: 'github', email: '...' }, { provider: 'google', email: '...' }]

// Unlink an account
await auth.unlinkOAuthAccount('google')

// Send magic link email
await auth.signInWithMagicLink({
  email: 'user@example.com',
  redirectTo: 'https://myapp.com/dashboard',
})

// User clicks link in email
// They're automatically signed in and redirected

// Check if user is signed in
const { user, session } = await auth.getSession()
if (user) {
  console.log('Signed in via magic link!')
}

// Get current session (client-side)
const { user, session } = await auth.getSession()

if (!user) {
  // Not authenticated
  redirect('/login')
}

// Access user data
console.log(user.id, user.email, user.metadata)

// Access tokens
console.log(session.access_token)
console.log(session.expires_at)

// Listen for auth state changes
auth.onAuthStateChange((event, session) => {
  switch (event) {
    case 'SIGNED_IN':
      console.log('User signed in:', session.user.email)
      break
    case 'SIGNED_OUT':
      console.log('User signed out')
      break
    case 'TOKEN_REFRESHED':
      console.log('Token refreshed')
      break
    case 'USER_UPDATED':
      console.log('User profile updated')
      break
  }
})

// Sign out current session
await auth.signOut()

// Sign out all sessions (all devices)
await auth.signOut({ scope: 'global' })

// Update user metadata
await auth.updateUser({
  metadata: {
    name: 'Jane Doe',
    avatar_url: 'https://example.com/new-avatar.png',
  },
})

// Update email (sends verification)
await auth.updateUser({
  email: 'newemail@example.com',
})

// Update password
await auth.updateUser({
  password: 'new-secure-password',
})

// User can delete their own account
await auth.deleteUser()

// This will:
// - Delete the user record
// - Invalidate all sessions
// - Trigger cascading deletes based on your DB schema

-- Enable RLS on a table
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;

-- Policy: Users can only see their own posts
CREATE POLICY "Users can view own posts"
  ON posts FOR SELECT
  USING (auth.uid() = user_id);

-- Policy: Users can only insert their own posts
CREATE POLICY "Users can insert own posts"
  ON posts FOR INSERT
  WITH CHECK (auth.uid() = user_id);

-- Policy: Users can only update their own posts
CREATE POLICY "Users can update own posts"
  ON posts FOR UPDATE
  USING (auth.uid() = user_id);

-- Policy: Users can only delete their own posts
CREATE POLICY "Users can delete own posts"
  ON posts FOR DELETE
  USING (auth.uid() = user_id);