ApiCore/ApiCore-Frontend/src/lib/profile/api.ts

import { apiFetch, apiFetchBlob, apiFetchFormData } from "@/lib/auth/api-client";
import { MfaEnrollment, ProfileSummary, UpdateProfileInput } from "./types";

export function updateProfile(input: UpdateProfileInput): Promise<ProfileSummary> {
  return apiFetch<ProfileSummary>("/profile", {
    method: "PATCH",
    body: JSON.stringify(input),
  });
}

export function changePassword(currentPassword: string, newPassword: string): Promise<void> {
  return apiFetch<void>("/profile/password", {
    method: "POST",
    body: JSON.stringify({ currentPassword, newPassword }),
  });
}

export function uploadAvatar(file: File): Promise<void> {
  const formData = new FormData();
  formData.append("file", file);
  return apiFetchFormData<void>("/profile/avatar", formData);
}

export function deleteAvatar(): Promise<void> {
  return apiFetch<void>("/profile/avatar", { method: "DELETE" });
}

// Fetches the avatar as a blob (the endpoint requires the caller's own
// Bearer token, so a plain <img src="..."> can't hit it directly) and hands
// back an object URL for use as an <img> source. Returns null when the user
// has no avatar (404) or the request otherwise fails.
export async function fetchAvatarUrl(): Promise<string | null> {
  try {
    const { blob } = await apiFetchBlob("/profile/avatar", "avatar");
    return URL.createObjectURL(blob);
  } catch {
    return null;
  }
}

export function enrollMfa(): Promise<MfaEnrollment> {
  return apiFetch<MfaEnrollment>("/profile/mfa/enroll", { method: "POST" });
}

export function confirmMfaEnrollment(setupToken: string, code: string): Promise<void> {
  return apiFetch<void>("/profile/mfa/enroll/confirm", {
    method: "POST",
    body: JSON.stringify({ setupToken, code }),
  });
}

export function disableMfa(currentPassword: string): Promise<void> {
  return apiFetch<void>("/profile/mfa/disable", {
    method: "POST",
    body: JSON.stringify({ currentPassword }),
  });
}