// Bearer-token storage for the ERPCore API client (docs/20-FRONTEND.md §1).
// Login (POST /auth/login) is not wired yet — reads simply return null until it is,
// and the API client omits the Authorization header in that case.

const STORAGE_KEY = "erpcore.accessToken"

export function getAccessToken(): string | null {
  if (typeof window === "undefined") return null
  return window.localStorage.getItem(STORAGE_KEY)
}

export function setAccessToken(token: string | null) {
  if (typeof window === "undefined") return
  if (token) window.localStorage.setItem(STORAGE_KEY, token)
  else window.localStorage.removeItem(STORAGE_KEY)
}