;(function(){
  var of = window.fetch
  window.fetch = function(u, o){ o = o || {}; if (!o.credentials) o.credentials = 'include'; return of(u, o) }
  function ensureOverlay(){
    var el = document.getElementById('authOverlay')
    if (el) return el
    el = document.createElement('div')
    el.id = 'authOverlay'
    el.style.position = 'fixed'
    el.style.left = '0'
    el.style.top = '0'
    el.style.width = '100%'
    el.style.height = '100%'
    el.style.background = 'rgba(0,0,0,0.6)'
    el.style.display = 'none'
    el.style.alignItems = 'center'
    el.style.justifyContent = 'center'
    el.style.zIndex = '9999'
    var box = document.createElement('div')
    box.style.background = '#fff'
    box.style.borderRadius = '8px'
    box.style.padding = '16px'
    box.style.boxShadow = '0 6px 24px rgba(0,0,0,0.25)'
    box.style.minWidth = '280px'
    var t = document.createElement('div')
    t.textContent = '鉴权失败'
    t.style.fontSize = '18px'
    t.style.marginBottom = '8px'
    var b = document.createElement('button')
    b.id = 'btnRecheck'
    b.textContent = '重新校验'
    b.style.padding = '8px 12px'
    b.style.border = '1px solid #999'
    b.style.borderRadius = '4px'
    b.style.background = '#f7f7f7'
    box.appendChild(t); box.appendChild(b)
    el.appendChild(box)
    document.body.appendChild(el)
    return el
  }
  function show(){
    ensureOverlay().style.display = 'flex'
    var main = document.querySelector('.container')
    if (main) main.style.display = 'none'
  }
  function hide(){
    var el = ensureOverlay()
    el.style.display = 'none'
    var main = document.querySelector('.container')
    if (main) main.style.display = 'block'
  }
  function removeTokenFromUrl(){
    var q = location.search || ''
    if (q.indexOf('token=') >= 0) {
      var sp = new URLSearchParams(q)
      sp.delete('token')
      var nu = location.pathname + (sp.toString() ? ('?' + sp.toString()) : '') + location.hash
      history.replaceState(null, '', nu)
    }
  }
  function handshake(){ return fetch('/api/psc/auth/handshake').then(function(r){ if(!r.ok) throw 0 }) }
  function start(cfg){
    if (!cfg || !cfg.enableCookieAuth) return
    var params = new URLSearchParams(location.search||'')
    var tk = params.get('token')
    var p = tk ? fetch('/api/psc/auth/token?token=' + encodeURIComponent(tk)).then(function(r){ if(r.ok) removeTokenFromUrl() }).catch(function(){}) : Promise.resolve()
    p.then(function(){ handshake().then(function(){ hide() }).catch(function(){ show() }) })
    var btn = document.getElementById('btnRecheck')
    if (btn) btn.onclick = function(){ handshake().then(function(){ hide() }).catch(function(){ show() }) }
  }
  function loadCfg(){ return fetch('auth_config.json').then(function(r){ return r.json() }).catch(function(){ return { enableCookieAuth: true } }) }
  document.addEventListener('DOMContentLoaded', function(){ loadCfg().then(start) })
})()