gem 'omniauth-clover-oauth2'

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :clover_oauth2,
           ENV['CLOVER_CLIENT_ID'],
           ENV['CLOVER_CLIENT_SECRET'],
           sandbox: Rails.env.development?
end

# Required for OmniAuth 2.0+
OmniAuth.config.allowed_request_methods = %i[get post]

config.omniauth :clover_oauth2,
                ENV['CLOVER_CLIENT_ID'],
                ENV['CLOVER_CLIENT_SECRET'],
                sandbox: !Rails.env.production?

devise_for :users, controllers: { omniauth_callbacks: 'users/omniauth_callbacks' }

devise :omniauthable, omniauth_providers: [:clover_oauth2]

class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def clover_oauth2
    @user = User.from_omniauth(request.env['omniauth.auth'])

    if @user.persisted?
      flash[:notice] = I18n.t('devise.omniauth_callbacks.success', kind: 'Clover')
      sign_in_and_redirect @user, event: :authentication
    else
      session['devise.clover_data'] = request.env['omniauth.auth'].except('extra')
      redirect_to new_user_registration_url, alert: @user.errors.full_messages.join("\n")
    end
  end

  def failure
    redirect_to root_path, alert: "Authentication failed: #{failure_message}"
  end
end

def self.from_omniauth(auth)
  where(provider: auth.provider, uid: auth.uid).first_or_create do |user|
    user.email = auth.info.email
    user.password = Devise.friendly_token[0, 20]
    user.name = auth.info.name
    # Add any other fields you need
  end
end

provider :clover_oauth2,
         ENV['CLOVER_CLIENT_ID'],
         ENV['CLOVER_CLIENT_SECRET'],
         sandbox: false  # Use production environment

{
  "provider" => "clover_oauth2",
  "uid" => "ABCD1234567890",
  "info" => {
    "email" => "employee@example.com",
    "first_name" => "John",
    "last_name" => "Doe",
    "name" => "John Doe",
    "merchant_id" => "ABCD1234567890",
    "employee_id" => "EFGH0987654321"
  },
  "credentials" => {
    "token" => "ACCESS_TOKEN",
    "refresh_token" => "REFRESH_TOKEN",
    "expires_at" => 1704067200,
    "expires" => true
  },
  "extra" => {
    "merchant_id" => "ABCD1234567890",
    "employee_id" => "EFGH0987654321",
    "business_name" => "Acme Restaurant",
    "raw_info" => {
      "merchant" => {
        "id" => "ABCD1234567890",
        "name" => "Acme Restaurant",
        "address" => { ... }
      },
      "employee" => {
        "id" => "EFGH0987654321",
        "name" => "John Doe",
        "email" => "employee@example.com",
        "role" => "ADMIN"
      }
    }
  }
}

def self.from_omniauth(auth)
  user = where(provider: auth.provider, uid: auth.uid).first_or_create do |u|
    u.email = auth.info.email
    u.password = Devise.friendly_token[0, 20]
  end

  # Update tokens on each login
  user.update(
    clover_access_token: auth.credentials.token,
    clover_refresh_token: auth.credentials.refresh_token,
    clover_token_expires_at: Time.at(auth.credentials.expires_at),
    clover_merchant_id: auth.info.merchant_id,
    clover_employee_id: auth.info.employee_id
  )

  user
end

# Create a client instance
client = OmniAuth::CloverOauth2::TokenClient.new(
  client_id: ENV['CLOVER_CLIENT_ID'],
  client_secret: ENV['CLOVER_CLIENT_SECRET'],
  sandbox: Rails.env.development?
)

# Refresh an expired token
result = client.refresh_token(user.clover_refresh_token)

if result.success?
  user.update!(
    clover_access_token: result.access_token,
    clover_refresh_token: result.refresh_token,
    clover_token_expires_at: Time.at(result.expires_at)
  )
else
  Rails.logger.error "Token refresh failed: #{result.error}"
end

# Check if token is expired (with 5-minute buffer by default)
client.token_expired?(user.clover_token_expires_at)

# Custom buffer (e.g., refresh 1 hour before expiry)
client.token_expired?(user.clover_token_expires_at, buffer_seconds: 3600)

# app/services/clover_api_service.rb
class CloverApiService
  def initialize(user)
    @user = user
    @client = OmniAuth::CloverOauth2::TokenClient.new(
      client_id: ENV['CLOVER_CLIENT_ID'],
      client_secret: ENV['CLOVER_CLIENT_SECRET'],
      sandbox: !Rails.env.production?
    )
  end

  def with_valid_token
    refresh_if_expired!
    yield @user.clover_access_token
  end

  private

  def refresh_if_expired!
    return unless @client.token_expired?(@user.clover_token_expires_at)

    result = @client.refresh_token(@user.clover_refresh_token)
    raise "Token refresh failed: #{result.error}" unless result.success?

    @user.update!(
      clover_access_token: result.access_token,
      clover_refresh_token: result.refresh_token,
      clover_token_expires_at: Time.at(result.expires_at)
    )
  end
end

# Usage
CloverApiService.new(current_user).with_valid_token do |token|
  # Make API calls with valid token
  response = Faraday.get("https://api.clover.com/v3/merchants/#{merchant_id}") do |req|
    req.headers['Authorization'] = "Bearer #{token}"
  end
end