class Api::SessionsController < ApplicationController
  skip_before_action :authenticate_request!, only: [:create]

  def create
    user = if params[:nickname].present? && params[:password].present?
      User.authenticate_by(params.permit(:nickname, :password))
    end

    if user
      token = JwtService.encode(user_id: user.id)
      render json: {
        user: user_response(user),
        token: token
      }
    else
      render json: { error: "Invalid nickname or password" }, status: :unauthorized
    end
  end

  def destroy
    # JWT is stateless; client should discard the token.
    # For server-side revocation, implement a token blacklist here.
    render json: { message: "Signed out successfully" }
  end

  def me
    render json: { user: user_response(current_user) }
  end

  private

  def user_response(user)
    {
      id: user.id,
      nickname: user.nickname,
      avatar_url: user.avatar.attached? ? url_for(user.avatar) : nil,
      created_at: user.created_at
    }
  end
end