AuthSharp.cs

using AuthSharp.SDK;
using AuthSharp.SDK.Classes;
using AuthSharp.SDK.Enums;
using AuthSharp.SDK.Exceptions;
using AuthSharp.SDK.Models;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
using RestSharp;
using System;
using System.Collections.Generic;
using System.Net;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Threading;
using System.Threading.Tasks;

namespace AuthSharp
{
    /// <summary>
    /// Main authentication client for interacting with the AuthSharp service.
    /// Handles user registration, login, session management, and license operations.
    /// </summary>
    public class AuthClient : IDisposable
    {
        private ApplicationConfig _appConfig;

        private SessionData _sessionData;

        private HTTP http;

        /// <summary>
        /// Initializes a new instance of the AuthClient class.
        /// </summary>
        /// <param name="ApplicationId">The unique identifier of your application.</param>
        /// <param name="PublicKeySha256">The SHA256 hash of the application's public key for validation.</param>
        public AuthClient(string ApplicationId, string PublicKeySha256)
        {
            _appConfig = new ApplicationConfig
            {
                Id = ApplicationId,
                PublicKeySha256 = PublicKeySha256
            };
            http = new HTTP();
        }

        /// <summary>
        /// Initializes the authentication client by retrieving the public key from the server and creating a secure session.
        /// This method must be called before any other operations.
        /// </summary>
        /// <exception cref="InitializationException">Thrown when the initialization fails or the public key cannot be retrieved.</exception>
        public void Init()
        {
            var req = new RestRequest("/api/v1/service/GetPublicKey", Method.Get);
            req.AddParameter("ApplicationId", _appConfig.Id);
            req.AddParameter("PublicSha", _appConfig.PublicKeySha256);

            var response = ExecuteRequest(req);
            if (response.StatusCode == System.Net.HttpStatusCode.OK)
            {
                _appConfig.PublicKey = Convert.FromBase64String(response.Content);
                _appConfig.SymmetricSecret = Encryption.CreateSymmetricKey();
                http.AddDefaultHeader("ApplicationId", _appConfig.Id);
                CreateSession();
            }
            else
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var data))
                {
                    message = " " + data.Value<string>("message");
                }

                throw new InitializationException($"Failed to initialize AuthClient.{message}");
            }
        }

        /// <summary>
        /// Asynchronously initializes the authentication client by retrieving the public key from the server and creating a secure session.
        /// This method must be called before any other operations.
        /// </summary>
        /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
        /// <exception cref="InitializationException">Thrown when the initialization fails or the public key cannot be retrieved.</exception>
        public async Task InitAsync(CancellationToken cancellationToken = default)
        {
            var req = new RestRequest("/api/v1/service/GetPublicKey", Method.Get);
            req.AddParameter("ApplicationId", _appConfig.Id);
            req.AddParameter("PublicSha", _appConfig.PublicKeySha256);

            var response = await ExecuteRequestAsync(req, cancellationToken);
            if (response.StatusCode == System.Net.HttpStatusCode.OK)
            {
                _appConfig.PublicKey = Convert.FromBase64String(response.Content);
                _appConfig.SymmetricSecret = Encryption.CreateSymmetricKey();
                http.AddDefaultHeader("ApplicationId", _appConfig.Id);
                await CreateSessionAsync(cancellationToken);
            }
            else
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var data))
                {
                    message = " " + data.Value<string>("message");
                }

                throw new InitializationException($"Failed to initialize AuthClient.{message}");
            }
        }

        private void CreateSession()
        {
            if (_appConfig.PublicKey == null || _appConfig.SymmetricSecret == null)
            {
                throw new InitializationException("AuthClient is not initialized. Call Init() before creating a session.");
            }

            var req = new RestRequest("/api/v1/service/CreateSession", Method.Post);
            var data = JsonConvert.SerializeObject(_appConfig.SymmetricSecret);
            var encryptedBody = Convert.ToBase64String(Encryption.RSA_Encrypt(data, _appConfig.PublicKey));
            req.AddJsonBody(new { body = encryptedBody });

            var response = ExecuteRequest(req);
            if (response.StatusCode != System.Net.HttpStatusCode.OK)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new SessionCreationException($"Failed to create session.{message}");
            }

            var encResponseBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encResponseBody.LoadFromEncryptedBody(response.Content);
            _sessionData = encResponseBody.ToObject<SessionData>();
            http.Client.AddDefaultHeaders(new Dictionary<string, string>
            {
                { "SessionId", _sessionData.SessionId },
                { "SessionToken", _sessionData.SessionToken }
            });
        }

        private async Task CreateSessionAsync(CancellationToken cancellationToken = default)
        {
            if (_appConfig.PublicKey == null || _appConfig.SymmetricSecret == null)
            {
                throw new InitializationException("AuthClient is not initialized. Call Init() before creating a session.");
            }

            var req = new RestRequest("/api/v1/service/CreateSession", Method.Post);
            var data = JsonConvert.SerializeObject(_appConfig.SymmetricSecret);
            var encryptedBody = Convert.ToBase64String(Encryption.RSA_Encrypt(data, _appConfig.PublicKey));
            req.AddJsonBody(new { body = encryptedBody });

            var response = await ExecuteRequestAsync(req, cancellationToken);
            if (response.StatusCode != System.Net.HttpStatusCode.OK)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new SessionCreationException($"Failed to create session.{message}");
            }

            var encResponseBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encResponseBody.LoadFromEncryptedBody(response.Content);
            _sessionData = encResponseBody.ToObject<SessionData>();
            http.Client.AddDefaultHeaders(new Dictionary<string, string>
            {
                { "SessionId", _sessionData.SessionId },
                { "SessionToken", _sessionData.SessionToken }
            });
        }

        /// <summary>
        /// Registers a new user with the specified credentials.
        /// </summary>
        /// <param name="Username">The desired username for the new account.</param>
        /// <param name="Password">The password for the new account.</param>
        /// <param name="LicenseKey">Optional license key for registration. Required if the application has license requirements.</param>
        /// <returns>A RegisterResult object containing the registration outcome and status message.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="ArgumentNullException">Thrown when Username or Password is null.</exception>
        /// <exception cref="UserRegistrationException">Thrown when the server encounters an error during registration.</exception>
        public RegisterResult Register(string Username, string Password, string LicenseKey = null)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }

            if (Username == null)
            {
                throw new ArgumentNullException(nameof(Username));
            }

            if (Password == null)
            {
                throw new ArgumentNullException(nameof(Password));
            }

            var req = new RestRequest("/api/v1/service/Register", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("Username", Username);
            encBody.Add("Password", Password);
            encBody.Add("Fingerprint", Fingerprint.GetSystemFingerprint());
            if (LicenseKey != null)
            {
                encBody.Add("LicenseKey", LicenseKey);
            }
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = ExecuteRequest(req);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new UserRegistrationException($"Failed to register user.{message}");
            }

            if (response.StatusCode == System.Net.HttpStatusCode.OK)
            {
                return new RegisterResult
                {
                    Result = RegisterResults.Success,
                    Message = "User registered successfully."
                };
            }
            else
            {
                var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
                resBody.LoadFromEncryptedBody(response.Content);
                var result = resBody.GetValue<int>("Result");
                var message = resBody.GetValue<string>("Message");
                var reason = resBody.GetValue<string>("Reason");
                var expiresAt = resBody.GetValue<DateTime?>("ExpiresAt");

                return new RegisterResult
                {
                    Result = (RegisterResults)result,
                    Message = message,
                    BlacklistReason = reason,
                    BlacklistExpiry = expiresAt
                };
            }
        }

        /// <summary>
        /// Asynchronously registers a new user with the specified credentials.
        /// </summary>
        /// <param name="Username">The desired username for the new account.</param>
        /// <param name="Password">The password for the new account.</param>
        /// <param name="LicenseKey">Optional license key for registration. Required if the application has license requirements.</param>
        /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
        /// <returns>A RegisterResult object containing the registration outcome and status message.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="ArgumentNullException">Thrown when Username or Password is null.</exception>
        /// <exception cref="UserRegistrationException">Thrown when the server encounters an error during registration.</exception>
        public async Task<RegisterResult> RegisterAsync(string Username, string Password, string LicenseKey = null, CancellationToken cancellationToken = default)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }

            if (Username == null)
            {
                throw new ArgumentNullException(nameof(Username));
            }

            if (Password == null)
            {
                throw new ArgumentNullException(nameof(Password));
            }

            var req = new RestRequest("/api/v1/service/Register", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("Username", Username);
            encBody.Add("Password", Password);
            encBody.Add("Fingerprint", Fingerprint.GetSystemFingerprint());
            if (LicenseKey != null)
            {
                encBody.Add("LicenseKey", LicenseKey);
            }
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = await ExecuteRequestAsync(req, cancellationToken);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new UserRegistrationException($"Failed to register user.{message}");
            }

            if (response.StatusCode == System.Net.HttpStatusCode.OK)
            {
                return new RegisterResult
                {
                    Result = RegisterResults.Success,
                    Message = "User registered successfully."
                };
            }
            else
            {
                var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
                resBody.LoadFromEncryptedBody(response.Content);
                var result = resBody.GetValue<int>("Result");
                var message = resBody.GetValue<string>("Message");
                var reason = resBody.GetValue<string>("Reason");
                var expiresAt = resBody.GetValue<DateTime?>("ExpiresAt");

                return new RegisterResult
                {
                    Result = (RegisterResults)result,
                    Message = message,
                    BlacklistReason = reason,
                    BlacklistExpiry = expiresAt
                };
            }
        }

        /// <summary>
        /// Authenticates a user with the provided credentials.
        /// </summary>
        /// <param name="Username">The username of the account to log in.</param>
        /// <param name="Password">The password of the account.</param>
        /// <returns>A LoginResult object containing the login status and user data if successful.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="ArgumentNullException">Thrown when Username or Password is null.</exception>
        /// <exception cref="UserLoginException">Thrown when the server encounters an error during login.</exception>
        public LoginResult Login(string Username, string Password)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }

            if (Username == null)
            {
                throw new ArgumentNullException(nameof(Username));
            }

            if (Password == null)
            {
                throw new ArgumentNullException(nameof(Password));
            }

            var req = new RestRequest("/api/v1/service/Login", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("Username", Username);
            encBody.Add("Password", Password);
            encBody.Add("Fingerprint", Fingerprint.GetSystemFingerprint());
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = ExecuteRequest(req);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new UserLoginException($"Failed to login.{message}");
            }

            if (response.StatusCode == System.Net.HttpStatusCode.OK)
            {
                var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
                resBody.LoadFromEncryptedBody(response.Content);

                var userData = resBody.GetValue("UserData").ToObject<User>();
                userData.SetAuthClient(this);
                return new LoginResult
                {
                    Result = LoginResults.Success,
                    UserData = userData
                };
            }
            else
            {
                var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
                resBody.LoadFromEncryptedBody(response.Content);
                var result = resBody.GetValue<int>("Result");
                var reason = resBody.GetValue<string>("Reason");
                var expiresAt = resBody.GetValue<DateTime?>("ExpiresAt");

                return new LoginResult
                {
                    Result = (LoginResults)result,
                    BlacklistReason = reason,
                    BlacklistExpiry = expiresAt
                };
            }
        }

        /// <summary>
        /// Asynchronously authenticates a user with the provided credentials.
        /// </summary>
        /// <param name="Username">The username of the account to log in.</param>
        /// <param name="Password">The password of the account.</param>
        /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
        /// <returns>A LoginResult object containing the login status and user data if successful.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="ArgumentNullException">Thrown when Username or Password is null.</exception>
        /// <exception cref="UserLoginException">Thrown when the server encounters an error during login.</exception>
        public async Task<LoginResult> LoginAsync(string Username, string Password, CancellationToken cancellationToken = default)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before logging in.");
            }

            if (Username == null)
            {
                throw new ArgumentNullException(nameof(Username));
            }

            if (Password == null)
            {
                throw new ArgumentNullException(nameof(Password));
            }

            var req = new RestRequest("/api/v1/service/Login", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("Username", Username);
            encBody.Add("Password", Password);
            encBody.Add("Fingerprint", Fingerprint.GetSystemFingerprint());
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = await ExecuteRequestAsync(req, cancellationToken);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new UserLoginException($"Failed to login.{message}");
            }

            if (response.StatusCode == System.Net.HttpStatusCode.OK)
            {
                var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
                resBody.LoadFromEncryptedBody(response.Content);

                var userData = resBody.GetValue("UserData").ToObject<User>();
                userData.SetAuthClient(this);
                return new LoginResult
                {
                    Result = LoginResults.Success,
                    UserData = userData
                };
            }
            else
            {
                var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
                resBody.LoadFromEncryptedBody(response.Content);
                var result = resBody.GetValue<int>("Result");
                var reason = resBody.GetValue<string>("Reason");
                var expiresAt = resBody.GetValue<DateTime?>("ExpiresAt");

                return new LoginResult
                {
                    Result = (LoginResults)result,
                    BlacklistReason = reason,
                    BlacklistExpiry = expiresAt
                };
            }
        }

        /// <summary>
        /// Retrieves a user-specific variable from the server.
        /// </summary>
        /// <typeparam name="T">The type of the variable value.</typeparam>
        /// <param name="variableName">The name of the variable to retrieve.</param>
        /// <returns>The value of the variable cast to type T.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="UserVariableFetchException">Thrown when the server encounters an error fetching the variable.</exception>
        internal T GetUserVariable<T>(string variableName)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }

            var req = new RestRequest("/api/v1/service/GetUserVariable", Method.Get);
            req.AddQueryParameter("variableName", variableName);

            var response = ExecuteRequest(req);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new UserVariableFetchException($"Failed to fetch user variable.{message}");
            }
            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            return resBody.GetValue<T>("Value");
        }

        /// <summary>
        /// Sets a user-specific variable on the server.
        /// </summary>
        /// <typeparam name="T">The type of the variable value.</typeparam>
        /// <param name="variableName">The name of the variable to set.</param>
        /// <param name="value">The value to store.</param>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="UserVariableSetException">Thrown when the server encounters an error setting the variable.</exception>
        internal void SetUserVariable<T>(string variableName, T value)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }

            var req = new RestRequest("/api/v1/service/SetUserVariable", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("VariableName", variableName);
            encBody.AddToken("Value", value);
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = ExecuteRequest(req);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new UserVariableSetException($"Failed to set user variable.{message}");
            }
            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            var result = resBody.GetValue<bool>("Success");
            var msg = resBody.GetValue<string>("Message");
            if (!result)
            {
                throw new UserVariableSetException("Failed to set user variable. Server returned an error." + (!string.IsNullOrEmpty(msg) ? $" message: {msg}" : ""));
            }
        }

        /// <summary>
        /// Deletes a user-specific variable from the server.
        /// </summary>
        /// <param name="variableName">The name of the variable to delete.</param>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="UserVariableDeleteException">Thrown when the server encounters an error deleting the variable.</exception>
        internal void DeleteUserVariable(string variableName)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }
            var req = new RestRequest("/api/v1/service/DeleteUserVariable", Method.Delete);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("VariableName", variableName);
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = ExecuteRequest(req);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new UserVariableDeleteException($"Failed to delete user variable.{message}");
            }
            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            var result = resBody.GetValue<bool>("Success");
            var msg = resBody.GetValue<string>("Message");
            if (!result)
            {
                throw new UserVariableDeleteException("Failed to delete user variable. Server returned an error." + (!string.IsNullOrEmpty(msg) ? $" message: {msg}" : ""));
            }
        }

        /// <summary>
        /// Retrieves an application-level variable from the server.
        /// Access may be restricted based on user permissions.
        /// </summary>
        /// <param name="variableName">The name of the application variable to retrieve.</param>
        /// <returns>A GetVariableResult object containing the variable value and any permission-related information.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="ApplicationVariableFetchException">Thrown when the server encounters an error fetching the variable.</exception>
        public GetVariableResult GetVariable(string variableName)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }

            var req = new RestRequest("/api/v1/service/GetVariable", Method.Get);
            req.AddQueryParameter("variableName", variableName);
            var response = ExecuteRequest(req);

            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new ApplicationVariableFetchException($"Failed to fetch application variable.{message}");
            }

            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);

            if (!resBody.GetValue<bool>("Success"))
            {
                return new GetVariableResult
                {
                    Success = false,
                    Message = resBody.GetValue<string>("Message"),
                    MissingPermissions = resBody.GetValue("MissingPermissions")?.ToObject<List<string>>(),
                    Value = null
                };
            }

            return new GetVariableResult
            {
                Success = true,
                Value = resBody.GetValue<string>("Value")
            };
        }

        /// <summary>
        /// Activates and redeems a license key for the current user.
        /// </summary>
        /// <param name="license">The license key to activate.</param>
        /// <returns>A RedeemLicenseResults value indicating the outcome of the license activation.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="LicenseRedemptionException">Thrown when the server encounters an error redeeming the license.</exception>
        public RedeemLicenseResults UseLicense(string license)
        { 
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }
            var req = new RestRequest("/api/v1/service/ActivateLicense", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("LicenseKey", license);
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = ExecuteRequest(req);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new LicenseRedemptionException($"Failed to redeem license.{message}");
            }
            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            var result = resBody.GetValue<int>("Result");

            return (RedeemLicenseResults)result;
        }

        /// <summary>
        /// Retrieves all licenses associated with the current user.
        /// </summary>
        /// <returns>An array of License objects representing the user's licenses.</returns>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="LicenseFetchException">Thrown when the server encounters an error fetching licenses.</exception>
        public License[] GetLicenses()
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before registering a user.");
            }
            var req = new RestRequest("/api/v1/service/GetLicenses", Method.Get);
            var response = ExecuteRequest(req);
            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new LicenseFetchException($"Failed to fetch licenses.{message}");
            }

            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            return resBody.GetValue("Licenses").ToObject<License[]>();
        }

        /// <summary>
        /// Changes the password for the currently authenticated user.
        /// </summary>
        /// <param name="oldPassword">The current password.</param>
        /// <param name="newPassword">The new password to set.</param>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called or user is not authenticated.</exception>
        /// <exception cref="ArgumentNullException">Thrown when oldPassword or newPassword is null.</exception>
        /// <exception cref="PasswordChangeException">Thrown when the password change fails.</exception>
        public void ChangePassword(string oldPassword, string newPassword)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before changing password.");
            }

            if (oldPassword == null)
            {
                throw new ArgumentNullException(nameof(oldPassword));
            }

            if (newPassword == null)
            {
                throw new ArgumentNullException(nameof(newPassword));
            }

            var req = new RestRequest("/api/v1/service/ChangePassword", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("OldPassword", oldPassword);
            encBody.Add("NewPassword", newPassword);
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = ExecuteRequest(req);

            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new PasswordChangeException($"Failed to change password.{message}");
            }

            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            var success = resBody.GetValue<bool>("Success");
            if (!success)
            {
                var msg = resBody.GetValue<string>("Message");
                throw new PasswordChangeException(!string.IsNullOrEmpty(msg) ? msg : "Failed to change password.");
            }
        }

        /// <summary>
        /// Asynchronously changes the password for the currently authenticated user.
        /// </summary>
        /// <param name="oldPassword">The current password.</param>
        /// <param name="newPassword">The new password to set.</param>
        /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called or user is not authenticated.</exception>
        /// <exception cref="ArgumentNullException">Thrown when oldPassword or newPassword is null.</exception>
        /// <exception cref="PasswordChangeException">Thrown when the password change fails.</exception>
        public async Task ChangePasswordAsync(string oldPassword, string newPassword, CancellationToken cancellationToken = default)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call InitAsync() before changing password.");
            }

            if (oldPassword == null)
            {
                throw new ArgumentNullException(nameof(oldPassword));
            }

            if (newPassword == null)
            {
                throw new ArgumentNullException(nameof(newPassword));
            }

            var req = new RestRequest("/api/v1/service/ChangePassword", Method.Post);
            var encBody = new EncryptedBody(_appConfig.SymmetricSecret);
            encBody.Add("OldPassword", oldPassword);
            encBody.Add("NewPassword", newPassword);
            req.AddJsonBody(encBody.ToEncryptedBody());
            var response = await ExecuteRequestAsync(req, cancellationToken);

            if ((int)response.StatusCode >= 500)
            {
                var content = response.Content;
                var message = string.Empty;
                if (content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }
                throw new PasswordChangeException($"Failed to change password.{message}");
            }

            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            var success = resBody.GetValue<bool>("Success");
            if (!success)
            {
                var msg = resBody.GetValue<string>("Message");
                throw new PasswordChangeException(!string.IsNullOrEmpty(msg) ? msg : "Failed to change password.");
            }
        }

        /// <summary>
        /// Logs out the current user and invalidates their session on the server.
        /// </summary>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="LogoutException">Thrown when the server encounters an error during logout.</exception>
        public void LogOut()
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before logging out.");
            }
            var req = new RestRequest("/api/v1/service/Logout", Method.Post);
            var response = ExecuteRequest(req);

            if (string.IsNullOrEmpty(response.Content))
            {
                throw new LogoutException("Server returned empty response.");
            }

            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            var success = resBody.GetValue<bool>("Success");
            if (!success)
            {
                var msg = resBody.GetValue<string>("Message");
                throw new LogoutException("Failed to log out. Server returned an error." + (!string.IsNullOrEmpty(msg) ? $" message: {msg}" : ""));
            }
        }

        /// <summary>
        /// Asynchronously logs out the current user and invalidates their session on the server.
        /// </summary>
        /// <param name="cancellationToken">The cancellation token to cancel the operation.</param>
        /// <exception cref="InvalidOperationException">Thrown when Init() has not been called.</exception>
        /// <exception cref="LogoutException">Thrown when the server encounters an error during logout.</exception>
        public async Task LogOutAsync(CancellationToken cancellationToken = default)
        {
            if (_sessionData == null)
            {
                throw new InvalidOperationException("Session is not created. Call Init() before logging out.");
            }
            var req = new RestRequest("/api/v1/service/Logout", Method.Post);
            var response = await ExecuteRequestAsync(req, cancellationToken);

            if (string.IsNullOrEmpty(response.Content))
            {
                throw new LogoutException("Server returned empty response.");
            }

            var resBody = new EncryptedBody(_appConfig.SymmetricSecret);
            resBody.LoadFromEncryptedBody(response.Content);
            var success = resBody.GetValue<bool>("Success");
            if (!success)
            {
                var msg = resBody.GetValue<string>("Message");
                throw new LogoutException("Failed to log out. Server returned an error." + (!string.IsNullOrEmpty(msg) ? $" message: {msg}" : ""));
            }
        }

        /// <summary>
        /// Disposes of the AuthClient and terminates the active session with the server.
        /// </summary>
        public void Dispose()
        {
            Dispose(true);
            GC.SuppressFinalize(this);
        }

        /// <summary>
        /// Protected implementation of Dispose pattern.
        /// </summary>
        /// <param name="disposing">Whether to dispose managed resources.</param>
        protected virtual void Dispose(bool disposing)
        {
            if (disposing)
            {
                // Terminate session on the server
                if (_sessionData != null)
                {
                    var req = new RestRequest("/api/v1/service/TerminateSession", Method.Post);
                    try
                    {
                        ExecuteRequest(req);
                    }
                    catch
                    {
                        // ignore errors during dispose
                    }
                }

                // Dispose of managed resources
                http?.Dispose();
                _sessionData = null;
                _appConfig = null;
            }
        }

        // Centralized execution + middleware checks for every request
        private RestResponse ExecuteRequest(RestRequest req)
        {
            var response = http.Client.Execute(req);

            if (response == null)
            {
                throw new UnableToConnectException("Unable to connect to AuthSharp server.");
            }

            // network-level failure
            if (response.StatusCode == 0)
            {
                throw new UnableToConnectException("Unable to connect to AuthSharp server.");
            }

            // unauthorized session handling - prefer explicit HTTP 401 but also attempt to parse body message
            if (response.StatusCode == HttpStatusCode.Unauthorized)
            {
                var message = string.Empty;
                if (!string.IsNullOrEmpty(response.Content) && response.Content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }

                throw new UnauthorizedSessionException($"Server responded with unauthorized session.{message}");
            }

            // In some setups server might return 200 with an encrypted payload that signals invalid session.
            // Try to detect that pattern: attempt to decrypt and check for a keyed "Unauthorized" flag or message.
            if (!string.IsNullOrEmpty(response.Content))
            {
                try
                {
                    var probe = new EncryptedBody(_appConfig.SymmetricSecret);
                    probe.LoadFromEncryptedBody(response.Content);
                    var maybeMsg = probe.GetValue<string>("Message");
                    if (!string.IsNullOrEmpty(maybeMsg) &&
                        (maybeMsg.IndexOf("unauthorized", StringComparison.OrdinalIgnoreCase) >= 0 ||
                         maybeMsg.IndexOf("invalid session", StringComparison.OrdinalIgnoreCase) >= 0 ||
                         maybeMsg.IndexOf("session expired", StringComparison.OrdinalIgnoreCase) >= 0))
                    {
                        throw new UnauthorizedSessionException($"Server responded with unauthorized session. message: {maybeMsg}");
                    }
                }
                catch
                {
                    // ignore failures here - parsing errors should not block normal flow
                }
            }

            return response;
        }

        // Centralized async execution + middleware checks for every request
        private async Task<RestResponse> ExecuteRequestAsync(RestRequest req, CancellationToken cancellationToken = default)
        {
            var response = await http.Client.ExecuteAsync(req, cancellationToken);

            if (response == null)
            {
                throw new UnableToConnectException("Unable to connect to AuthSharp server.");
            }

            // network-level failure
            if (response.StatusCode == 0)
            {
                throw new UnableToConnectException("Unable to connect to AuthSharp server.");
            }

            // unauthorized session handling - prefer explicit HTTP 401 but also attempt to parse body message
            if (response.StatusCode == HttpStatusCode.Unauthorized)
            {
                var message = string.Empty;
                if (!string.IsNullOrEmpty(response.Content) && response.Content.TryParseJObject(out var resData))
                {
                    message = " " + resData.Value<string>("message");
                }

                throw new UnauthorizedSessionException($"Server responded with unauthorized session.{message}");
            }

            // In some setups server might return 200 with an encrypted payload that signals invalid session.
            // Try to detect that pattern: attempt to decrypt and check for a keyed "Unauthorized" flag or message.
            if (!string.IsNullOrEmpty(response.Content))
            {
                try
                {
                    var probe = new EncryptedBody(_appConfig.SymmetricSecret);
                    probe.LoadFromEncryptedBody(response.Content);
                    var maybeMsg = probe.GetValue<string>("Message");
                    if (!string.IsNullOrEmpty(maybeMsg) &&
                        (maybeMsg.IndexOf("unauthorized", StringComparison.OrdinalIgnoreCase) >= 0 ||
                         maybeMsg.IndexOf("invalid session", StringComparison.OrdinalIgnoreCase) >= 0 ||
                         maybeMsg.IndexOf("session expired", StringComparison.OrdinalIgnoreCase) >= 0))
                    {
                        throw new UnauthorizedSessionException($"Server responded with unauthorized session. message: {maybeMsg}");
                    }
                }
                catch (Exception ex) when (ex is JsonException || ex is FormatException)
                {
                    // Expected exceptions during probing - ignore
                }
            }

            return response;
        }
    }
}