(function () {
  "use strict";

  let configPromise = null;
  let captchaScriptPromise = null;
  let csrfToken = "";

  async function loadConfig(force = false) {
    if (!configPromise || force) {
      configPromise = fetch("api/public-config.php", {
        credentials: "same-origin",
        cache: "no-store"
      }).then(async response => {
        const data = await response.json();
        if (!response.ok || !data.ok) throw new Error(data.error || "Помилка безпеки форми");
        csrfToken = data.csrf_token || "";
        return data;
      });
    }
    return configPromise;
  }

  async function secureFetch(url, options = {}, retry = true) {
    await loadConfig();
    const method = String(options.method || "GET").toUpperCase();
    const headers = new Headers(options.headers || {});
    if (!["GET", "HEAD", "OPTIONS"].includes(method)) {
      headers.set("X-CSRF-Token", csrfToken);
    }
    const response = await fetch(url, {
      ...options,
      headers,
      credentials: "same-origin"
    });
    if (response.status === 403 && retry) {
      await loadConfig(true);
      return secureFetch(url, options, false);
    }
    return response;
  }

  function addHoneypot(form) {
    if (!form || form.querySelector('[name="website"]')) return;
    const wrapper = document.createElement("div");
    wrapper.className = "mps-honeypot";
    wrapper.setAttribute("aria-hidden", "true");
    wrapper.innerHTML = '<label>Website<input name="website" type="text" tabindex="-1" autocomplete="off"></label>';
    form.appendChild(wrapper);
  }

  function loadCaptchaScript() {
    if (window.hcaptcha) return Promise.resolve();
    if (!captchaScriptPromise) {
      captchaScriptPromise = new Promise((resolve, reject) => {
        const script = document.createElement("script");
        script.src = "https://js.hcaptcha.com/1/api.js?render=explicit";
        script.async = true;
        script.defer = true;
        script.dataset.mpsHcaptcha = "1";
        script.onload = resolve;
        script.onerror = reject;
        document.head.appendChild(script);
      });
    }
    return captchaScriptPromise;
  }

  async function prepareForm(form) {
    if (!form) return;
    addHoneypot(form);
    const config = await loadConfig();
    if (!config.hcaptcha_site_key || form.querySelector(".h-captcha")) return;

    const widget = document.createElement("div");
    widget.className = "h-captcha";
    const submit = form.querySelector('[type="submit"]');
    if (submit) submit.before(widget); else form.appendChild(widget);

    await loadCaptchaScript();
    if (window.hcaptcha && !widget.dataset.widgetId) {
      const widgetId = window.hcaptcha.render(widget, { sitekey: config.hcaptcha_site_key });
      widget.dataset.widgetId = String(widgetId);
    }
  }

  window.MPSSecurity = {
    fetch: secureFetch,
    getConfig: loadConfig,
    getCsrfToken: async () => {
      await loadConfig();
      return csrfToken;
    },
    addHoneypot,
    prepareForm
  };

  document.addEventListener("DOMContentLoaded", () => {
    document.querySelectorAll("#requestForm, #estimateForm, #callbackForm").forEach(form => {
      prepareForm(form).catch(() => {});
    });
  });
})();