zoom_app/zoom_app/ViewController.swift

//
//  ViewController.swift
//  zoom_app
//
//  Created by Dev Mac 1 on 14/04/2026.
//

import Cocoa
import CryptoKit
import Network
import WebKit

class ViewController: NSViewController {
    private let googleOAuth = GoogleOAuthService.shared
    private let zoomOAuth = ZoomOAuthService.shared
    private let loginStateKey = "zoom_app.isLoggedIn"
    private let sidebarWidth: CGFloat = 78
    private let appBackground = NSColor(calibratedRed: 10 / 255, green: 11 / 255, blue: 12 / 255, alpha: 1)
    private let sidebarBackground = NSColor(calibratedRed: 16 / 255, green: 17 / 255, blue: 19 / 255, alpha: 1)
    private let sidebarActiveBackground = NSColor(calibratedRed: 22 / 255, green: 23 / 255, blue: 26 / 255, alpha: 1)
    private let cardBackground = NSColor(calibratedRed: 20 / 255, green: 21 / 255, blue: 24 / 255, alpha: 1)
    private let secondaryCardBackground = NSColor(calibratedRed: 22 / 255, green: 23 / 255, blue: 26 / 255, alpha: 1)
    private let appShellBackground = NSColor(calibratedRed: 10 / 255, green: 11 / 255, blue: 12 / 255, alpha: 1)
    private let contentShellBackground = NSColor(calibratedRed: 10 / 255, green: 11 / 255, blue: 12 / 255, alpha: 1)
    private let topStripBackground = NSColor(calibratedRed: 22 / 255, green: 23 / 255, blue: 26 / 255, alpha: 1)
    private let searchPillBackground = NSColor.white.withAlphaComponent(0.06)
    private let meetingCardBackground = NSColor(calibratedRed: 30 / 255, green: 34 / 255, blue: 42 / 255, alpha: 1)
    private let titleBarControlBackground = NSColor.white.withAlphaComponent(0.04)
    private let titleBarLightControlBackground = NSColor.white.withAlphaComponent(0.02)
    private let appShellCornerRadius: CGFloat = 20
    private let homeChromeHeaderHeight: CGFloat = 56
    private let nativeTrafficLightsLeading: CGFloat = 14
    private let nativeTrafficLightsTopInset: CGFloat = 20
    private let accentBlue = NSColor(calibratedRed: 27 / 255, green: 115 / 255, blue: 232 / 255, alpha: 1)
    private let accentOrange = NSColor(calibratedRed: 1.0, green: 0.60, blue: 0.20, alpha: 1)
    private let primaryText = NSColor(calibratedWhite: 0.98, alpha: 1)
    private let secondaryText = NSColor(calibratedWhite: 0.78, alpha: 1)
    private let mutedText = NSColor(calibratedWhite: 0.66, alpha: 1)

    private let rootContainer = NSView()
    private var loginView: NSView?
    private var homeView: NSView?
    private weak var googleButton: NSButton?
    private weak var nextSignInButton: NSButton?
    private weak var zoomSocialButton: NSButton?
    private weak var timeLabel: NSTextField?
    private weak var dateLabel: NSTextField?
    private weak var emptyMeetingLabel: NSTextField?
    private weak var meetingsListStack: NSStackView?
    private weak var meetingsStatusLabel: NSTextField?
    private weak var meetingsScrollView: NSScrollView?
    private var clockTimer: Timer?
    private var meetingsRefreshTimer: Timer?
    private var isSigningIn = false
    private var isPromptingZoomCredentials = false
    private var isLoadingMeetings = false
    private var meetingsScrollObserver: NSObjectProtocol?
    private var lastMeetingsRefreshAt = Date.distantPast
    private var lastScrollEdgeRefreshAt = Date.distantPast
    private let meetingsRefreshInterval: TimeInterval = 8
    private let scrollRefreshCooldown: TimeInterval = 3
    
    private enum SidebarStyle {
        case login
        case home
    }

    override func viewDidLoad() {
        super.viewDidLoad()
        setupUI()
    }

    override func viewDidAppear() {
        super.viewDidAppear()
        if let window = view.window {
            window.setContentSize(NSSize(width: 1020, height: 690))
            // Use full-size content view so custom top chrome sits in the titlebar region.
            window.titleVisibility = .hidden
            window.titlebarAppearsTransparent = true
            window.isMovableByWindowBackground = true
            window.styleMask.insert(.fullSizeContentView)
        }
        alignNativeTrafficLights()
        if isUserLoggedIn() {
            showHomeView(profile: nil)
        } else {
            showLoginView()
        }
    }

    override func viewDidLayout() {
        super.viewDidLayout()
        alignNativeTrafficLights()
    }

    private func setupUI() {
        view.wantsLayer = true
        view.layer?.backgroundColor = appBackground.cgColor

        rootContainer.translatesAutoresizingMaskIntoConstraints = false
        view.addSubview(rootContainer)
        NSLayoutConstraint.activate([
            rootContainer.leadingAnchor.constraint(equalTo: view.leadingAnchor),
            rootContainer.trailingAnchor.constraint(equalTo: view.trailingAnchor),
            rootContainer.topAnchor.constraint(equalTo: view.topAnchor),
            rootContainer.bottomAnchor.constraint(equalTo: view.bottomAnchor)
        ])
    }

    private func showLoginView() {
        clockTimer?.invalidate()
        meetingsRefreshTimer?.invalidate()
        meetingsRefreshTimer = nil
        clearMeetingsScrollObserver()
        homeView?.removeFromSuperview()
        homeView = nil
        isSigningIn = false
        nextSignInButton?.title = "Next"
        nextSignInButton?.isEnabled = true
        zoomSocialButton?.isEnabled = true

        if loginView == nil {
            loginView = makeLoginView()
        }
        guard let loginView else { return }
        attachToRoot(loginView)
    }

    private func showHomeView(profile: GoogleUserProfile?) {
        loginView?.removeFromSuperview()
        clearMeetingsScrollObserver()
        homeView?.removeFromSuperview()
        homeView = makeHomeView(profile: profile)
        if let homeView { attachToRoot(homeView) }
        persistLoggedInState(true)
        startClock()
        startMeetingsAutoRefresh()
        triggerMeetingsRefresh(force: true)
    }

    private func isUserLoggedIn() -> Bool {
        UserDefaults.standard.bool(forKey: loginStateKey)
    }

    private func persistLoggedInState(_ loggedIn: Bool) {
        UserDefaults.standard.set(loggedIn, forKey: loginStateKey)
    }

    private func attachToRoot(_ subview: NSView) {
        subview.translatesAutoresizingMaskIntoConstraints = false
        if subview.superview != rootContainer {
            rootContainer.addSubview(subview)
        }
        NSLayoutConstraint.activate([
            subview.leadingAnchor.constraint(equalTo: rootContainer.leadingAnchor),
            subview.trailingAnchor.constraint(equalTo: rootContainer.trailingAnchor),
            subview.topAnchor.constraint(equalTo: rootContainer.topAnchor),
            subview.bottomAnchor.constraint(equalTo: rootContainer.bottomAnchor)
        ])
    }

    @objc private func googleLoginTapped() {
        guard isSigningIn == false else { return }
        isSigningIn = true
        googleButton?.title = "..."
        googleButton?.isEnabled = false

        Task {
            do {
                let token = try await googleOAuth.validAccessToken(presentingWindow: view.window)
                let profile = try? await googleOAuth.fetchUserProfile(accessToken: token)
                await MainActor.run {
                    self.isSigningIn = false
                    self.googleButton?.title = "G"
                    self.googleButton?.isEnabled = true
                    self.showHomeView(profile: profile)
                }
            } catch {
                await MainActor.run {
                    self.isSigningIn = false
                    self.googleButton?.title = "G"
                    self.googleButton?.isEnabled = true
                    self.showSimpleError("Google login failed", error: error)
                }
            }
        }
    }

    /// Primary Zoom sign-in: browser OAuth, token refresh, then home with scheduled meetings.
    @objc private func zoomPrimarySignInTapped() {
        guard isSigningIn == false else { return }
        isSigningIn = true
        nextSignInButton?.title = "Signing in…"
        nextSignInButton?.isEnabled = false
        zoomSocialButton?.isEnabled = false
        googleButton?.isEnabled = false

        Task {
            do {
                let configured = await MainActor.run { self.ensureZoomOAuthClientConfigured() }
                guard configured else {
                    await MainActor.run { self.resetLoginSigningInState() }
                    return
                }

                let zoomToken = try await zoomOAuth.validAccessToken(presentingWindow: view.window)
                let zoomUser = try? await fetchZoomUserProfile(accessToken: zoomToken)
                let profile = zoomUser.map { GoogleUserProfile(name: $0.displayName, email: $0.email, picture: $0.pictureURL) }

                await MainActor.run {
                    self.resetLoginSigningInState()
                    self.showHomeView(profile: profile)
                }
            } catch {
                await MainActor.run {
                    self.resetLoginSigningInState()
                    self.showSimpleError("Zoom sign-in failed", error: error)
                }
            }
        }
    }

    @objc private func scheduleMeetingWebTapped() {
        guard let url = URL(string: "https://zoom.us/meeting/schedule") else { return }
        let opened = NSWorkspace.shared.open(url)
        if opened == false {
            meetingsStatusLabel?.stringValue = "Unable to open Zoom schedule page."
        }
    }

    @objc private func logoutTapped() {
        meetingsRefreshTimer?.invalidate()
        meetingsRefreshTimer = nil
        clearMeetingsScrollObserver()
        googleOAuth.clearSavedTokens()
        zoomOAuth.clearSavedTokens()
        persistLoggedInState(false)
        showLoginView()
    }
    
    @objc private func topBarPlaceholderTapped() {
        // Reserved for future titlebar control actions.
    }

    private func startMeetingsAutoRefresh() {
        meetingsRefreshTimer?.invalidate()
        // Poll Zoom meetings periodically so newly scheduled meetings appear automatically.
        meetingsRefreshTimer = Timer.scheduledTimer(withTimeInterval: meetingsRefreshInterval, repeats: true) { [weak self] _ in
            guard let self else { return }
            self.triggerMeetingsRefresh()
        }
    }

    private func triggerMeetingsRefresh(force: Bool = false) {
        let now = Date()
        if force == false, now.timeIntervalSince(lastMeetingsRefreshAt) < meetingsRefreshInterval {
            return
        }
        lastMeetingsRefreshAt = now
        Task { await self.loadScheduledMeetings() }
    }

    private func clearMeetingsScrollObserver() {
        if let meetingsScrollObserver {
            NotificationCenter.default.removeObserver(meetingsScrollObserver)
        }
        meetingsScrollObserver = nil
        meetingsScrollView?.contentView.postsBoundsChangedNotifications = false
        meetingsScrollView = nil
    }

    private func observeMeetingsScrollEdges(in scrollView: NSScrollView) {
        clearMeetingsScrollObserver()
        meetingsScrollView = scrollView
        scrollView.contentView.postsBoundsChangedNotifications = true
        meetingsScrollObserver = NotificationCenter.default.addObserver(
            forName: NSView.boundsDidChangeNotification,
            object: scrollView.contentView,
            queue: .main
        ) { [weak self, weak scrollView] _ in
            guard let self, let scrollView else { return }
            self.refreshMeetingsIfScrolledToEdge(scrollView)
        }
    }

    private func refreshMeetingsIfScrolledToEdge(_ scrollView: NSScrollView) {
        guard let documentView = scrollView.documentView else { return }

        let visibleRect = scrollView.contentView.bounds
        let contentHeight = documentView.bounds.height
        let viewportHeight = visibleRect.height
        if contentHeight <= viewportHeight + 2 {
            return
        }

        let maxOffset = max(contentHeight - viewportHeight, 0)
        let y = visibleRect.origin.y
        let threshold: CGFloat = 12
        let reachedTop = y <= threshold
        let reachedBottom = y >= (maxOffset - threshold)
        guard reachedTop || reachedBottom else { return }

        let now = Date()
        if now.timeIntervalSince(lastScrollEdgeRefreshAt) < scrollRefreshCooldown {
            return
        }
        lastScrollEdgeRefreshAt = now
        triggerMeetingsRefresh(force: true)
    }

    @MainActor
    private func resetLoginSigningInState() {
        isSigningIn = false
        nextSignInButton?.title = "Next"
        nextSignInButton?.isEnabled = true
        zoomSocialButton?.isEnabled = true
        googleButton?.isEnabled = true
    }

    /// Returns false if the user cancelled or left credentials empty.
    @MainActor
    private func ensureZoomOAuthClientConfigured() -> Bool {
        if zoomOAuth.configuredClientId() != nil, zoomOAuth.configuredClientSecret() != nil {
            return true
        }
        return presentZoomOAuthCredentialPrompt()
    }

    private func showSimpleError(_ title: String, error: Error) {
        let alert = NSAlert()
        alert.alertStyle = .warning
        alert.messageText = title
        alert.informativeText = error.localizedDescription
        alert.runModal()
    }

    private struct ScheduledMeeting {
        let title: String
        let start: Date
        let end: Date?
        let host: String
        let source: String
    }

    @MainActor
    private func applyMeetings(_ meetings: [ScheduledMeeting]) {
        guard let stack = meetingsListStack else { return }
        stack.arrangedSubviews.forEach { view in
            stack.removeArrangedSubview(view)
            view.removeFromSuperview()
        }

        let ordered = meetings.sorted(by: { $0.start < $1.start })
        if ordered.isEmpty {
            emptyMeetingLabel?.isHidden = false
            meetingsStatusLabel?.stringValue = "No upcoming Zoom meetings found."
            return
        }

        emptyMeetingLabel?.isHidden = true
        meetingsStatusLabel?.stringValue = "Zoom meetings"
        for meeting in ordered {
            stack.addArrangedSubview(makeMeetingRowCard(meeting))
        }
    }

    private func loadScheduledMeetings() async {
        if isLoadingMeetings { return }
        isLoadingMeetings = true
        defer { isLoadingMeetings = false }
        do {
            let zoomToken = try await zoomOAuth.validAccessToken(presentingWindow: view.window)
            let zoomMeetings = try await fetchZoomScheduledMeetings(accessToken: zoomToken)
            await MainActor.run {
                self.applyMeetings(zoomMeetings)
            }
        } catch {
            await MainActor.run {
                self.applyMeetings([])
                if case ZoomOAuthError.missingClientId = error {
                    self.meetingsStatusLabel?.stringValue = "Zoom OAuth app not configured."
                    self.promptForZoomOAuthCredentialsIfNeeded()
                } else if case ZoomOAuthError.missingClientSecret = error {
                    self.meetingsStatusLabel?.stringValue = "Zoom OAuth app not configured."
                    self.promptForZoomOAuthCredentialsIfNeeded()
                } else if case ZoomOAuthError.missingRequiredScope(let scopeMessage) = error {
                    self.zoomOAuth.clearSavedTokens()
                    self.meetingsStatusLabel?.stringValue = "Zoom OAuth scope missing. Add required scopes in Marketplace, click Add app now, then sign in again. (\(scopeMessage))"
                } else {
                    self.meetingsStatusLabel?.stringValue = "Zoom API error: \(error.localizedDescription)"
                }
            }
        }
    }

    @MainActor
    private func presentZoomOAuthCredentialPrompt() -> Bool {
        let alert = NSAlert()
        alert.alertStyle = .informational
        alert.messageText = "Configure Zoom OAuth"
        alert.informativeText = "Enter your Zoom Marketplace OAuth app Client ID and Client Secret once (or set ZoomOAuthClientId in Info.plist and ZOOM_OAUTH_CLIENT_SECRET in the run environment). After this, sign-in and token refresh run automatically."

        let wrapper = NSStackView()
        wrapper.orientation = .vertical
        wrapper.spacing = 8
        wrapper.translatesAutoresizingMaskIntoConstraints = false

        let clientIdField = NSTextField()
        clientIdField.placeholderString = "Zoom Client ID"
        clientIdField.stringValue = zoomOAuth.configuredClientId() ?? ""
        let clientSecretField = NSSecureTextField()
        clientSecretField.placeholderString = "Zoom Client Secret"
        clientSecretField.stringValue = zoomOAuth.configuredClientSecret() ?? ""
        [clientIdField, clientSecretField].forEach { field in
            field.translatesAutoresizingMaskIntoConstraints = false
            field.widthAnchor.constraint(equalToConstant: 420).isActive = true
            wrapper.addArrangedSubview(field)
        }
        alert.accessoryView = wrapper

        alert.addButton(withTitle: "Save")
        alert.addButton(withTitle: "Cancel")

        let result = alert.runModal()
        if result == .alertFirstButtonReturn {
            var clientId = clientIdField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines)
            var clientSecret = clientSecretField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines)
            if clientId.isEmpty { clientId = zoomOAuth.configuredClientId() ?? "" }
            if clientSecret.isEmpty { clientSecret = zoomOAuth.configuredClientSecret() ?? "" }
            if clientId.isEmpty == false, clientSecret.isEmpty == false {
                zoomOAuth.setClientCredentials(clientId: clientId, clientSecret: clientSecret)
                return true
            }
            meetingsStatusLabel?.stringValue = "Both Zoom OAuth Client ID and Client Secret are required (or set bundled values / ZOOM_OAUTH_CLIENT_SECRET)."
        }
        return false
    }

    @MainActor
    private func promptForZoomOAuthCredentialsIfNeeded() {
        guard isPromptingZoomCredentials == false else { return }
        isPromptingZoomCredentials = true
        defer { isPromptingZoomCredentials = false }

        if presentZoomOAuthCredentialPrompt() {
            meetingsStatusLabel?.stringValue = "Configured. Starting Zoom OAuth..."
            Task { await self.loadScheduledMeetings() }
        }
    }

    private struct ZoomUserMeResponse: Decodable {
        let first_name: String?
        let last_name: String?
        let display_name: String?
        let email: String?
        let pic_url: String?

        var displayName: String? {
            if let display_name, display_name.isEmpty == false { return display_name }
            let parts = [first_name, last_name].compactMap { $0 }.filter { $0.isEmpty == false }
            return parts.isEmpty ? nil : parts.joined(separator: " ")
        }

        var pictureURL: String? {
            guard let pic_url, pic_url.isEmpty == false else { return nil }
            return pic_url
        }
    }

    private func fetchZoomUserProfile(accessToken: String) async throws -> ZoomUserMeResponse {
        let url = URL(string: "https://api.zoom.us/v2/users/me")!
        var request = URLRequest(url: url)
        request.httpMethod = "GET"
        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")

        let (data, response) = try await URLSession.shared.data(for: request)
        guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
            throw GoogleOAuthError.tokenExchangeFailed(String(data: data, encoding: .utf8) ?? "Failed to load Zoom profile")
        }
        return try JSONDecoder().decode(ZoomUserMeResponse.self, from: data)
    }

    private func fetchZoomScheduledMeetings(accessToken: String) async throws -> [ScheduledMeeting] {
        struct ZoomMeeting: Decodable {
            let topic: String?
            let start_time: String?
            let duration: Int?
            let host_id: String?
        }

        struct ZoomMeetingsPage: Decodable {
            let meetings: [ZoomMeeting]
            let next_page_token: String?
        }

        let iso = ISO8601DateFormatter()
        iso.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
        let fallbackISO = ISO8601DateFormatter()
        fallbackISO.formatOptions = [.withInternetDateTime]

        func mapMeetings(_ raw: [ZoomMeeting]) -> [ScheduledMeeting] {
            raw.compactMap { meeting in
                guard let startRaw = meeting.start_time else { return nil }
                let start = iso.date(from: startRaw) ?? fallbackISO.date(from: startRaw)
                guard let start else { return nil }
                let end = meeting.duration.map { start.addingTimeInterval(TimeInterval($0 * 60)) }
                return ScheduledMeeting(
                    title: meeting.topic?.isEmpty == false ? meeting.topic! : "Zoom meeting",
                    start: start,
                    end: end,
                    host: meeting.host_id ?? "Zoom Host",
                    source: "Zoom"
                )
            }
        }

        var allMeetings: [ZoomMeeting] = []
        var nextPageToken: String?
        repeat {
            var components = URLComponents(string: "https://api.zoom.us/v2/users/me/meetings")!
            var items: [URLQueryItem] = [
                URLQueryItem(name: "type", value: "scheduled"),
                URLQueryItem(name: "page_size", value: "30")
            ]
            if let nextPageToken, nextPageToken.isEmpty == false {
                items.append(URLQueryItem(name: "next_page_token", value: nextPageToken))
            }
            components.queryItems = items
            var request = URLRequest(url: components.url!)
            request.httpMethod = "GET"
            request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")

            let (data, response) = try await URLSession.shared.data(for: request)
            guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
                let raw = String(data: data, encoding: .utf8) ?? "Failed to load Zoom meetings"
                if raw.localizedCaseInsensitiveContains("does not contain scopes") {
                    throw ZoomOAuthError.missingRequiredScope(raw)
                }
                throw GoogleOAuthError.tokenExchangeFailed(raw)
            }

            let decoded = try JSONDecoder().decode(ZoomMeetingsPage.self, from: data)
            allMeetings.append(contentsOf: decoded.meetings)
            let token = decoded.next_page_token?.trimmingCharacters(in: .whitespacesAndNewlines)
            nextPageToken = (token?.isEmpty == false) ? token : nil
        } while nextPageToken != nil

        return mapMeetings(allMeetings)
    }

    // MARK: - Login UI

    private func makeLoginView() -> NSView {
        let root = NSView()
        let sidebar = makeSidebar(items: ["Home", "Chat", "Phone", "Docs", "Whiteboards", "Clips", "More"], selected: "Home", style: .login)
        let content = NSView()

        root.addSubview(sidebar)
        root.addSubview(content)
        sidebar.translatesAutoresizingMaskIntoConstraints = false
        content.translatesAutoresizingMaskIntoConstraints = false

        NSLayoutConstraint.activate([
            sidebar.leadingAnchor.constraint(equalTo: root.leadingAnchor),
            sidebar.topAnchor.constraint(equalTo: root.topAnchor),
            sidebar.bottomAnchor.constraint(equalTo: root.bottomAnchor),
            sidebar.widthAnchor.constraint(equalToConstant: sidebarWidth),
            content.leadingAnchor.constraint(equalTo: sidebar.trailingAnchor),
            content.trailingAnchor.constraint(equalTo: root.trailingAnchor),
            content.topAnchor.constraint(equalTo: root.topAnchor),
            content.bottomAnchor.constraint(equalTo: root.bottomAnchor)
        ])

        let back = makeLabel("‹  Back", size: 32, color: accentBlue, weight: .regular, centered: false)
        let logo = makeLabel("zoom\nWorkplace", size: 24, color: primaryText, weight: .bold, centered: true)
        logo.maximumNumberOfLines = 2
        let domain = makeLabel("us05web.zoom.us", size: 16, color: primaryText, weight: .semibold, centered: true)

        let emailField = NSTextField()
        emailField.placeholderString = "Email or phone number"
        emailField.font = .systemFont(ofSize: 20, weight: .regular)
        emailField.textColor = .white
        emailField.wantsLayer = true
        emailField.layer?.cornerRadius = 10
        emailField.layer?.borderWidth = 1.5
        emailField.layer?.borderColor = accentBlue.cgColor
        emailField.layer?.backgroundColor = cardBackground.cgColor
        emailField.focusRingType = .none

        let nextButton = NSButton(title: "Next", target: self, action: #selector(zoomPrimarySignInTapped))
        nextButton.font = .systemFont(ofSize: 20, weight: .semibold)
        nextButton.isBordered = false
        nextButton.wantsLayer = true
        nextButton.layer?.cornerRadius = 10
        nextButton.layer?.backgroundColor = cardBackground.cgColor
        nextButton.contentTintColor = primaryText

        let divider = NSBox()
        divider.boxType = .separator
        let socialText = makeLabel("or sign in with", size: 14, color: secondaryText, weight: .regular, centered: true)

        let sso = makeSocialButton(icon: "🔑", text: "SSO")
        let google = makeSocialButton(icon: "G", text: "Google", action: #selector(googleLoginTapped))
        let apple = makeSocialButton(icon: "", text: "Apple")
        let facebook = makeSocialButton(icon: "f", text: "Facebook")
        let zoomSocial = makeSocialButton(icon: "Z", text: "Zoom", action: #selector(zoomPrimarySignInTapped))
        self.googleButton = google.button
        self.nextSignInButton = nextButton
        self.zoomSocialButton = zoomSocial.button

        let social = NSStackView(views: [sso.container, google.container, apple.container, facebook.container, zoomSocial.container])
        social.orientation = .horizontal
        social.spacing = 14
        social.distribution = .fillEqually

        let signup = makeLabel("Don't have an account? Sign up", size: 15, color: primaryText, weight: .regular, centered: true)
        let footer = makeLabel("Help    Terms    Privacy", size: 14, color: accentBlue, weight: .regular, centered: true)

        [back, logo, domain, emailField, nextButton, divider, socialText, social, signup, footer].forEach {
            $0.translatesAutoresizingMaskIntoConstraints = false
            content.addSubview($0)
        }

        NSLayoutConstraint.activate([
            back.topAnchor.constraint(equalTo: content.topAnchor, constant: 24),
            back.leadingAnchor.constraint(equalTo: content.leadingAnchor, constant: 34),
            logo.topAnchor.constraint(equalTo: content.topAnchor, constant: 118),
            logo.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            domain.topAnchor.constraint(equalTo: logo.bottomAnchor, constant: 12),
            domain.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            emailField.topAnchor.constraint(equalTo: domain.bottomAnchor, constant: 30),
            emailField.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            emailField.widthAnchor.constraint(equalToConstant: 520),
            emailField.heightAnchor.constraint(equalToConstant: 52),
            nextButton.topAnchor.constraint(equalTo: emailField.bottomAnchor, constant: 20),
            nextButton.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            nextButton.widthAnchor.constraint(equalTo: emailField.widthAnchor),
            nextButton.heightAnchor.constraint(equalToConstant: 52),
            divider.topAnchor.constraint(equalTo: nextButton.bottomAnchor, constant: 28),
            divider.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            divider.widthAnchor.constraint(equalTo: emailField.widthAnchor),
            socialText.centerYAnchor.constraint(equalTo: divider.centerYAnchor),
            socialText.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            social.topAnchor.constraint(equalTo: divider.bottomAnchor, constant: 18),
            social.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            social.widthAnchor.constraint(equalTo: emailField.widthAnchor),
            signup.topAnchor.constraint(equalTo: social.bottomAnchor, constant: 14),
            signup.centerXAnchor.constraint(equalTo: content.centerXAnchor),
            footer.bottomAnchor.constraint(equalTo: content.bottomAnchor, constant: -16),
            footer.centerXAnchor.constraint(equalTo: content.centerXAnchor)
        ])

        return root
    }

    // MARK: - Home UI

    private func makeHomeView(profile: GoogleUserProfile?) -> NSView {
        let root = NSView()
        let shell = NSView()
        shell.wantsLayer = true
        shell.layer?.backgroundColor = appShellBackground.cgColor
        shell.layer?.cornerRadius = appShellCornerRadius
        shell.layer?.borderWidth = 1
        shell.layer?.borderColor = NSColor.white.withAlphaComponent(0.06).cgColor
        let chromeColumn = NSView()
        chromeColumn.wantsLayer = true
        chromeColumn.layer?.backgroundColor = NSColor.white.withAlphaComponent(0.03).cgColor
        let chromeDivider = NSView()
        chromeDivider.wantsLayer = true
        chromeDivider.layer?.backgroundColor = NSColor.black.withAlphaComponent(0.32).cgColor
        let chromeHeader = NSView()
        chromeHeader.wantsLayer = true
        chromeHeader.layer?.backgroundColor = NSColor.clear.cgColor
        let sidebar = makeSidebar(items: ["Home", "Meetings", "Chat", "Scheduler", "Hub", "More"], selected: "Home", style: .home)
        let content = NSView()
        content.wantsLayer = true
        content.layer?.backgroundColor = NSColor.clear.cgColor

        root.addSubview(shell)
        shell.addSubview(chromeColumn)
        shell.addSubview(content)
        chromeColumn.addSubview(chromeDivider)
        chromeColumn.addSubview(chromeHeader)
        chromeColumn.addSubview(sidebar)
        shell.translatesAutoresizingMaskIntoConstraints = false
        chromeColumn.translatesAutoresizingMaskIntoConstraints = false
        chromeDivider.translatesAutoresizingMaskIntoConstraints = false
        chromeHeader.translatesAutoresizingMaskIntoConstraints = false
        sidebar.translatesAutoresizingMaskIntoConstraints = false
        content.translatesAutoresizingMaskIntoConstraints = false

        NSLayoutConstraint.activate([
            shell.leadingAnchor.constraint(equalTo: root.leadingAnchor, constant: 8),
            shell.trailingAnchor.constraint(equalTo: root.trailingAnchor, constant: -8),
            shell.topAnchor.constraint(equalTo: root.topAnchor, constant: 0),
            shell.bottomAnchor.constraint(equalTo: root.bottomAnchor, constant: -8),
            chromeColumn.leadingAnchor.constraint(equalTo: shell.leadingAnchor),
            chromeColumn.topAnchor.constraint(equalTo: shell.topAnchor),
            chromeColumn.bottomAnchor.constraint(equalTo: shell.bottomAnchor),
            chromeColumn.widthAnchor.constraint(equalToConstant: 146),
            chromeDivider.topAnchor.constraint(equalTo: chromeColumn.topAnchor),
            chromeDivider.bottomAnchor.constraint(equalTo: chromeColumn.bottomAnchor),
            chromeDivider.trailingAnchor.constraint(equalTo: chromeColumn.trailingAnchor),
            chromeDivider.widthAnchor.constraint(equalToConstant: 1),
            chromeHeader.topAnchor.constraint(equalTo: chromeColumn.topAnchor),
            chromeHeader.leadingAnchor.constraint(equalTo: chromeColumn.leadingAnchor),
            chromeHeader.trailingAnchor.constraint(equalTo: chromeColumn.trailingAnchor),
            chromeHeader.heightAnchor.constraint(equalToConstant: homeChromeHeaderHeight),
            sidebar.leadingAnchor.constraint(equalTo: chromeColumn.leadingAnchor),
            sidebar.trailingAnchor.constraint(equalTo: chromeColumn.trailingAnchor),
            sidebar.topAnchor.constraint(equalTo: chromeHeader.bottomAnchor, constant: 2),
            sidebar.bottomAnchor.constraint(equalTo: chromeColumn.bottomAnchor),
            content.leadingAnchor.constraint(equalTo: chromeColumn.trailingAnchor),
            content.trailingAnchor.constraint(equalTo: shell.trailingAnchor),
            content.topAnchor.constraint(equalTo: shell.topAnchor),
            content.bottomAnchor.constraint(equalTo: shell.bottomAnchor)
        ])

        let brandStack = NSStackView()
        brandStack.orientation = .vertical
        brandStack.spacing = 0
        brandStack.alignment = .leading
        let brandTop = makeLabel("zoom", size: 14, color: primaryText, weight: .semibold, centered: false)
        let brandBottom = makeLabel("Workplace", size: 27, color: primaryText, weight: .bold, centered: false)
        brandBottom.font = .systemFont(ofSize: 14, weight: .bold)
        [brandTop, brandBottom].forEach { brandStack.addArrangedSubview($0) }

        let topBar = NSView()
        topBar.wantsLayer = true
        topBar.layer?.backgroundColor = NSColor.white.withAlphaComponent(0.03).cgColor
        
        let topBarDivider = NSView()
        topBarDivider.wantsLayer = true
        topBarDivider.layer?.backgroundColor = NSColor.white.withAlphaComponent(0.06).cgColor

        let searchPill = NSView()
        searchPill.wantsLayer = true
        searchPill.layer?.backgroundColor = searchPillBackground.cgColor
        searchPill.layer?.cornerRadius = 10
        let search = makeLabel("Search (\u{2318}E)", size: 13, color: mutedText, weight: .regular, centered: true)
        
        let leftTopBarCluster = NSStackView()
        leftTopBarCluster.orientation = .horizontal
        leftTopBarCluster.spacing = 10
        leftTopBarCluster.alignment = .centerY
        let backButton = makeTopBarGlyphButton(symbol: "chevron.left", action: #selector(topBarPlaceholderTapped))
        let forwardButton = makeTopBarGlyphButton(symbol: "chevron.right", action: #selector(topBarPlaceholderTapped))
        let historyButton = makeTopBarGlyphButton(symbol: "clock.arrow.circlepath", action: #selector(topBarPlaceholderTapped))
        [backButton, forwardButton, historyButton].forEach { leftTopBarCluster.addArrangedSubview($0) }
        
        let rightTopBarCluster = NSStackView()
        rightTopBarCluster.orientation = .horizontal
        rightTopBarCluster.spacing = 8
        rightTopBarCluster.alignment = .centerY
        let plusButton = makeTopBarGlyphButton(symbol: "plus", action: #selector(topBarPlaceholderTapped))
        let notificationButton = makeTopBarGlyphButton(symbol: "bell", action: #selector(topBarPlaceholderTapped))
        let appsButton = makeTopBarIconButton(symbol: "square.grid.2x2", action: #selector(topBarPlaceholderTapped))

        let profileChip = NSButton(title: String((profile?.name ?? "H").prefix(1)).uppercased(), target: self, action: #selector(logoutTapped))
        profileChip.isBordered = false
        profileChip.wantsLayer = true
        profileChip.layer?.backgroundColor = accentBlue.withAlphaComponent(0.75).cgColor
        profileChip.layer?.cornerRadius = 10
        profileChip.contentTintColor = primaryText
        profileChip.font = .systemFont(ofSize: 14, weight: .bold)
        profileChip.toolTip = "Profile (click to logout)"
        [plusButton, notificationButton, appsButton, profileChip].forEach { rightTopBarCluster.addArrangedSubview($0) }

        let welcome = makeLabel("Home", size: 15, color: secondaryText, weight: .medium, centered: false)
        let timeTitle = makeLabel("--:--", size: 56, color: primaryText, weight: .bold, centered: true)
        let dateTitle = makeLabel("-", size: 16, color: secondaryText, weight: .regular, centered: true)

        let actions = NSStackView(views: [
            makeActionTile(title: "New meeting", symbol: "video.fill", color: accentOrange),
            makeActionTile(title: "Join", symbol: "plus", color: accentBlue),
            makeActionTile(title: "Schedule", symbol: "calendar", color: accentBlue, action: #selector(scheduleMeetingWebTapped)),
            makeActionTile(title: "Share screen", symbol: "rectangle.portrait.and.arrow.forward", color: accentBlue),
            makeActionTile(title: "My notes", symbol: "pencil", color: accentBlue)
        ])
        actions.orientation = .horizontal
        actions.spacing = 16
        actions.alignment = .centerY
        actions.distribution = .fillEqually

        let panel = NSView()
        panel.wantsLayer = true
        panel.layer?.backgroundColor = secondaryCardBackground.withAlphaComponent(0.94).cgColor
        panel.layer?.cornerRadius = 16
        panel.layer?.borderWidth = 1
        panel.layer?.borderColor = NSColor.white.withAlphaComponent(0.07).cgColor
        
        let panelHeaderStrip = NSView()
        panelHeaderStrip.wantsLayer = true
        panelHeaderStrip.layer?.backgroundColor = NSColor.white.withAlphaComponent(0.03).cgColor
        panelHeaderStrip.layer?.cornerRadius = 12

        let todaysDateFormatter = DateFormatter()
        todaysDateFormatter.dateFormat = "EEEE, MMM d"
        let panelHeader = makeLabel(todaysDateFormatter.string(from: Date()), size: 21, color: primaryText, weight: .semibold, centered: false)
        let meetingsStatus = makeLabel("Upcoming meetings", size: 12, color: secondaryText, weight: .medium, centered: false)
        let noMeeting = makeLabel("No meetings scheduled for today.", size: 18, color: secondaryText, weight: .regular, centered: true)
        let meetingsScrollView = NSScrollView()
        meetingsScrollView.drawsBackground = false
        meetingsScrollView.hasVerticalScroller = true
        meetingsScrollView.hasHorizontalScroller = false
        meetingsScrollView.autohidesScrollers = true

        let meetingsDocument = NSView()
        let meetingsStack = NSStackView()
        meetingsStack.orientation = .vertical
        meetingsStack.spacing = 10
        meetingsStack.alignment = .leading
        let openRecordings = NSButton(title: "Open recordings", target: nil, action: nil)
        openRecordings.isBordered = false
        openRecordings.font = .systemFont(ofSize: 14, weight: .semibold)
        openRecordings.contentTintColor = primaryText
        openRecordings.wantsLayer = true
        openRecordings.layer?.backgroundColor = NSColor(calibratedRed: 36 / 255, green: 39 / 255, blue: 46 / 255, alpha: 1).cgColor
        openRecordings.layer?.cornerRadius = 11
        openRecordings.layer?.borderWidth = 1
        openRecordings.layer?.borderColor = NSColor.white.withAlphaComponent(0.07).cgColor

        let contentPanel = NSView()
        contentPanel.wantsLayer = true
        contentPanel.layer?.backgroundColor = contentShellBackground.cgColor
        contentPanel.layer?.cornerRadius = 12
        contentPanel.layer?.borderWidth = 1
        contentPanel.layer?.borderColor = NSColor.white.withAlphaComponent(0.04).cgColor
        let contentColumn = NSView()
        contentColumn.translatesAutoresizingMaskIntoConstraints = false
        content.addSubview(topBar)
        content.addSubview(topBarDivider)
        content.addSubview(contentPanel)
        contentPanel.addSubview(contentColumn)

        [brandStack, leftTopBarCluster, rightTopBarCluster, searchPill, search].forEach {
            $0.translatesAutoresizingMaskIntoConstraints = false
        }
        [brandStack].forEach {
            chromeHeader.addSubview($0)
        }
        [leftTopBarCluster, rightTopBarCluster, searchPill, search].forEach {
            $0.translatesAutoresizingMaskIntoConstraints = false
            topBar.addSubview($0)
        }
        [welcome, timeTitle, dateTitle, actions, panel, panelHeaderStrip, panelHeader, meetingsStatus, noMeeting, meetingsScrollView, openRecordings].forEach {
            $0.translatesAutoresizingMaskIntoConstraints = false
            contentColumn.addSubview($0)
        }
        topBar.translatesAutoresizingMaskIntoConstraints = false
        topBarDivider.translatesAutoresizingMaskIntoConstraints = false
        contentPanel.translatesAutoresizingMaskIntoConstraints = false
        meetingsDocument.translatesAutoresizingMaskIntoConstraints = false
        meetingsStack.translatesAutoresizingMaskIntoConstraints = false
        meetingsScrollView.documentView = meetingsDocument
        meetingsDocument.addSubview(meetingsStack)

        NSLayoutConstraint.activate([
            brandStack.leadingAnchor.constraint(equalTo: chromeHeader.leadingAnchor, constant: 72),
            brandStack.centerYAnchor.constraint(equalTo: chromeHeader.centerYAnchor, constant: -1),

            topBar.topAnchor.constraint(equalTo: content.topAnchor),
            topBar.leadingAnchor.constraint(equalTo: content.leadingAnchor),
            topBar.trailingAnchor.constraint(equalTo: content.trailingAnchor),
            topBar.heightAnchor.constraint(equalToConstant: 56),
            topBarDivider.topAnchor.constraint(equalTo: topBar.bottomAnchor),
            topBarDivider.leadingAnchor.constraint(equalTo: content.leadingAnchor),
            topBarDivider.trailingAnchor.constraint(equalTo: content.trailingAnchor),
            topBarDivider.heightAnchor.constraint(equalToConstant: 1),

            contentPanel.topAnchor.constraint(equalTo: topBarDivider.bottomAnchor, constant: 6),
            contentPanel.leadingAnchor.constraint(equalTo: content.leadingAnchor, constant: 8),
            contentPanel.trailingAnchor.constraint(equalTo: content.trailingAnchor, constant: -8),
            contentPanel.bottomAnchor.constraint(equalTo: content.bottomAnchor, constant: -8),

            contentColumn.topAnchor.constraint(equalTo: contentPanel.topAnchor),
            contentColumn.bottomAnchor.constraint(equalTo: contentPanel.bottomAnchor),
            contentColumn.leadingAnchor.constraint(equalTo: contentPanel.leadingAnchor),
            contentColumn.trailingAnchor.constraint(equalTo: contentPanel.trailingAnchor),

            leftTopBarCluster.leadingAnchor.constraint(equalTo: topBar.leadingAnchor, constant: 16),
            leftTopBarCluster.centerYAnchor.constraint(equalTo: topBar.centerYAnchor),
            rightTopBarCluster.trailingAnchor.constraint(equalTo: topBar.trailingAnchor, constant: -12),
            rightTopBarCluster.centerYAnchor.constraint(equalTo: topBar.centerYAnchor),

            searchPill.centerXAnchor.constraint(equalTo: topBar.centerXAnchor),
            searchPill.centerYAnchor.constraint(equalTo: topBar.centerYAnchor),
            searchPill.heightAnchor.constraint(equalToConstant: 32),
            searchPill.widthAnchor.constraint(equalToConstant: 320),
            searchPill.leadingAnchor.constraint(greaterThanOrEqualTo: leftTopBarCluster.trailingAnchor, constant: 12),
            searchPill.trailingAnchor.constraint(lessThanOrEqualTo: rightTopBarCluster.leadingAnchor, constant: -12),
            search.leadingAnchor.constraint(equalTo: searchPill.leadingAnchor, constant: 12),
            search.trailingAnchor.constraint(equalTo: searchPill.trailingAnchor, constant: -12),
            search.centerYAnchor.constraint(equalTo: searchPill.centerYAnchor),
            profileChip.widthAnchor.constraint(equalToConstant: 34),
            profileChip.heightAnchor.constraint(equalToConstant: 34),

            welcome.topAnchor.constraint(equalTo: contentColumn.topAnchor, constant: 22),
            welcome.centerXAnchor.constraint(equalTo: contentColumn.centerXAnchor),

            timeTitle.topAnchor.constraint(equalTo: welcome.bottomAnchor, constant: 12),
            timeTitle.centerXAnchor.constraint(equalTo: contentColumn.centerXAnchor),
            dateTitle.topAnchor.constraint(equalTo: timeTitle.bottomAnchor, constant: 6),
            dateTitle.centerXAnchor.constraint(equalTo: contentColumn.centerXAnchor),

            actions.topAnchor.constraint(equalTo: dateTitle.bottomAnchor, constant: 28),
            actions.centerXAnchor.constraint(equalTo: contentColumn.centerXAnchor),
            actions.leadingAnchor.constraint(greaterThanOrEqualTo: contentColumn.leadingAnchor, constant: 18),
            actions.trailingAnchor.constraint(lessThanOrEqualTo: contentColumn.trailingAnchor, constant: -18),
            actions.heightAnchor.constraint(equalToConstant: 100),

            panel.topAnchor.constraint(equalTo: actions.bottomAnchor, constant: 22),
            panel.leadingAnchor.constraint(equalTo: contentColumn.leadingAnchor, constant: 26),
            panel.trailingAnchor.constraint(equalTo: contentColumn.trailingAnchor, constant: -26),
            panel.heightAnchor.constraint(equalToConstant: 316),
            panel.bottomAnchor.constraint(lessThanOrEqualTo: contentColumn.bottomAnchor, constant: -24),
            
            panelHeaderStrip.topAnchor.constraint(equalTo: panel.topAnchor, constant: 10),
            panelHeaderStrip.leadingAnchor.constraint(equalTo: panel.leadingAnchor, constant: 10),
            panelHeaderStrip.trailingAnchor.constraint(equalTo: panel.trailingAnchor, constant: -10),
            panelHeaderStrip.heightAnchor.constraint(equalToConstant: 44),

            panelHeader.centerYAnchor.constraint(equalTo: panelHeaderStrip.centerYAnchor),
            panelHeader.leadingAnchor.constraint(equalTo: panelHeaderStrip.leadingAnchor, constant: 14),
            meetingsStatus.centerYAnchor.constraint(equalTo: panelHeaderStrip.centerYAnchor),
            meetingsStatus.trailingAnchor.constraint(equalTo: panelHeaderStrip.trailingAnchor, constant: -14),
            noMeeting.leadingAnchor.constraint(equalTo: panel.leadingAnchor, constant: 18),
            noMeeting.trailingAnchor.constraint(equalTo: panel.trailingAnchor, constant: -18),
            noMeeting.centerYAnchor.constraint(equalTo: panel.centerYAnchor),

            meetingsScrollView.topAnchor.constraint(equalTo: panelHeaderStrip.bottomAnchor, constant: 10),
            meetingsScrollView.leadingAnchor.constraint(equalTo: panel.leadingAnchor, constant: 14),
            meetingsScrollView.trailingAnchor.constraint(equalTo: panel.trailingAnchor, constant: -14),
            meetingsScrollView.bottomAnchor.constraint(equalTo: openRecordings.topAnchor, constant: -14),

            meetingsDocument.widthAnchor.constraint(equalTo: meetingsScrollView.contentView.widthAnchor),
            meetingsStack.topAnchor.constraint(equalTo: meetingsDocument.topAnchor),
            meetingsStack.leadingAnchor.constraint(equalTo: meetingsDocument.leadingAnchor),
            meetingsStack.trailingAnchor.constraint(equalTo: meetingsDocument.trailingAnchor),
            meetingsStack.bottomAnchor.constraint(equalTo: meetingsDocument.bottomAnchor),

            openRecordings.leadingAnchor.constraint(equalTo: panel.leadingAnchor, constant: 14),
            openRecordings.trailingAnchor.constraint(equalTo: panel.trailingAnchor, constant: -14),
            openRecordings.bottomAnchor.constraint(equalTo: panel.bottomAnchor, constant: -12),
            openRecordings.heightAnchor.constraint(equalToConstant: 40)
        ])

        timeLabel = timeTitle
        dateLabel = dateTitle
        meetingsListStack = meetingsStack
        meetingsStatusLabel = meetingsStatus
        emptyMeetingLabel = noMeeting
        observeMeetingsScrollEdges(in: meetingsScrollView)
        updateClock()
        return root
    }

    private func startClock() {
        clockTimer?.invalidate()
        clockTimer = Timer.scheduledTimer(withTimeInterval: 1, repeats: true) { [weak self] _ in
            self?.updateClock()
        }
        updateClock()
    }

    private func updateClock() {
        let now = Date()
        let timeFormatter = DateFormatter()
        timeFormatter.dateFormat = "h:mm a"
        let dateFormatter = DateFormatter()
        dateFormatter.dateFormat = "EEEE, d MMM"
        timeLabel?.stringValue = timeFormatter.string(from: now)
        dateLabel?.stringValue = dateFormatter.string(from: now)
    }

    // MARK: - Shared UI

    private func makeSidebar(items: [String], selected: String, style: SidebarStyle = .login) -> NSView {
        let sidebar = NSView()
        sidebar.wantsLayer = true
        sidebar.layer?.backgroundColor = (style == .home ? NSColor.white.withAlphaComponent(0.03) : sidebarBackground).cgColor

        let stack = NSStackView()
        stack.orientation = .vertical
        stack.spacing = style == .home ? 12 : 16
        stack.alignment = .centerX
        stack.translatesAutoresizingMaskIntoConstraints = false
        sidebar.addSubview(stack)

        for item in items {
            let row = NSView()
            row.translatesAutoresizingMaskIntoConstraints = false
            row.wantsLayer = true
            let selectedRow = item == selected
            row.layer?.backgroundColor = selectedRow ? sidebarActiveBackground.withAlphaComponent(0.95).cgColor : NSColor.clear.cgColor
            row.layer?.cornerRadius = style == .home ? 12 : 10
            row.widthAnchor.constraint(equalToConstant: style == .home ? 68 : 70).isActive = true

            let icon = makeLabel(selectedRow ? "⌂" : "◻︎", size: style == .home ? 14 : 15, color: primaryText, weight: .regular, centered: true)
            let label = makeLabel(item, size: style == .home ? 10 : 11, color: selectedRow ? primaryText : secondaryText, weight: .regular, centered: true)
            [icon, label].forEach {
                $0.translatesAutoresizingMaskIntoConstraints = false
                row.addSubview($0)
            }
            NSLayoutConstraint.activate([
                icon.topAnchor.constraint(equalTo: row.topAnchor, constant: style == .home ? 8 : 10),
                icon.centerXAnchor.constraint(equalTo: row.centerXAnchor),
                label.topAnchor.constraint(equalTo: icon.bottomAnchor, constant: style == .home ? 4 : 5),
                label.centerXAnchor.constraint(equalTo: row.centerXAnchor),
                label.bottomAnchor.constraint(equalTo: row.bottomAnchor, constant: style == .home ? -7 : -8)
            ])
            stack.addArrangedSubview(row)
        }
        
        if style == .home {
            let spacer = NSView()
            spacer.translatesAutoresizingMaskIntoConstraints = false
            spacer.heightAnchor.constraint(greaterThanOrEqualToConstant: 12).isActive = true
            stack.addArrangedSubview(spacer)
            
            let settingsBadge = NSView()
            settingsBadge.wantsLayer = true
            settingsBadge.layer?.backgroundColor = NSColor.white.withAlphaComponent(0.03).cgColor
            settingsBadge.layer?.cornerRadius = 12
            settingsBadge.translatesAutoresizingMaskIntoConstraints = false
            settingsBadge.widthAnchor.constraint(equalToConstant: 40).isActive = true
            settingsBadge.heightAnchor.constraint(equalToConstant: 40).isActive = true
            let gear = makeLabel("⚙︎", size: 14, color: secondaryText, weight: .regular, centered: true)
            gear.translatesAutoresizingMaskIntoConstraints = false
            settingsBadge.addSubview(gear)
            NSLayoutConstraint.activate([
                gear.centerXAnchor.constraint(equalTo: settingsBadge.centerXAnchor),
                gear.centerYAnchor.constraint(equalTo: settingsBadge.centerYAnchor)
            ])
            stack.addArrangedSubview(settingsBadge)
        }

        NSLayoutConstraint.activate([
            stack.topAnchor.constraint(equalTo: sidebar.topAnchor, constant: style == .home ? 8 : 18),
            stack.leadingAnchor.constraint(equalTo: sidebar.leadingAnchor, constant: 4),
            stack.trailingAnchor.constraint(equalTo: sidebar.trailingAnchor, constant: -4)
        ])
        if style == .home {
            stack.bottomAnchor.constraint(lessThanOrEqualTo: sidebar.bottomAnchor, constant: -18).isActive = true
        }

        return sidebar
    }

    @MainActor
    private func alignNativeTrafficLights() {
        guard let window = view.window else { return }
        guard let closeButton = window.standardWindowButton(.closeButton),
              let miniButton = window.standardWindowButton(.miniaturizeButton),
              let zoomButton = window.standardWindowButton(.zoomButton) else { return }
        guard let buttonContainer = closeButton.superview else { return }

        let buttons = [closeButton, miniButton, zoomButton]
        // Compute from top inset so moving "down" is stable in titlebar coordinates.
        let containerHeight = buttonContainer.bounds.height
        let targetY = max(0, containerHeight - closeButton.frame.height - nativeTrafficLightsTopInset)
        var nextX = nativeTrafficLightsLeading

        for button in buttons {
            button.setFrameOrigin(NSPoint(x: nextX, y: targetY))
            nextX += button.frame.width + 8
        }
    }

    private func makeTopBarIconButton(symbol: String, action: Selector?) -> NSButton {
        let button = NSButton(title: "", target: action == nil ? nil : self, action: action)
        button.isBordered = false
        button.wantsLayer = true
        button.layer?.backgroundColor = titleBarControlBackground.cgColor
        button.layer?.cornerRadius = 10
        button.layer?.borderWidth = 1
        button.layer?.borderColor = NSColor.white.withAlphaComponent(0.05).cgColor
        button.contentTintColor = secondaryText
        button.image = NSImage(systemSymbolName: symbol, accessibilityDescription: symbol)
        button.imageScaling = .scaleProportionallyUpOrDown
        button.translatesAutoresizingMaskIntoConstraints = false
        button.widthAnchor.constraint(equalToConstant: 30).isActive = true
        button.heightAnchor.constraint(equalToConstant: 30).isActive = true
        return button
    }
    
    private func makeTopBarGlyphButton(symbol: String, action: Selector?) -> NSButton {
        let button = NSButton(title: "", target: action == nil ? nil : self, action: action)
        button.isBordered = false
        button.wantsLayer = true
        button.layer?.backgroundColor = titleBarLightControlBackground.cgColor
        button.layer?.cornerRadius = 9
        button.layer?.borderWidth = 1
        button.layer?.borderColor = NSColor.white.withAlphaComponent(0.03).cgColor
        button.contentTintColor = secondaryText
        button.image = NSImage(systemSymbolName: symbol, accessibilityDescription: symbol)
        button.imageScaling = .scaleProportionallyUpOrDown
        button.translatesAutoresizingMaskIntoConstraints = false
        button.widthAnchor.constraint(equalToConstant: 26).isActive = true
        button.heightAnchor.constraint(equalToConstant: 26).isActive = true
        return button
    }

    private func makeActionTile(title: String, symbol: String, color: NSColor, action: Selector? = nil) -> NSView {
        let root = NSView()
        root.translatesAutoresizingMaskIntoConstraints = false
        root.widthAnchor.constraint(equalToConstant: 104).isActive = true
        root.heightAnchor.constraint(equalToConstant: 100).isActive = true

        let iconButton = NSButton(title: "", target: action == nil ? nil : self, action: action)
        iconButton.isBordered = false
        iconButton.wantsLayer = true
        iconButton.layer?.backgroundColor = color.cgColor
        iconButton.layer?.cornerRadius = 20
        iconButton.layer?.shadowOpacity = 0.2
        iconButton.layer?.shadowRadius = 7
        iconButton.layer?.shadowOffset = NSSize(width: 0, height: -1)
        iconButton.image = NSImage(systemSymbolName: symbol, accessibilityDescription: title)
        iconButton.contentTintColor = .white
        iconButton.imageScaling = .scaleProportionallyUpOrDown
        let label = makeLabel(title, size: 14, color: secondaryText, weight: .regular, centered: true)

        [iconButton, label].forEach {
            $0.translatesAutoresizingMaskIntoConstraints = false
            root.addSubview($0)
        }
        NSLayoutConstraint.activate([
            iconButton.topAnchor.constraint(equalTo: root.topAnchor),
            iconButton.centerXAnchor.constraint(equalTo: root.centerXAnchor),
            iconButton.widthAnchor.constraint(equalToConstant: 64),
            iconButton.heightAnchor.constraint(equalToConstant: 64),
            label.topAnchor.constraint(equalTo: iconButton.bottomAnchor, constant: 10),
            label.centerXAnchor.constraint(equalTo: root.centerXAnchor),
            label.bottomAnchor.constraint(equalTo: root.bottomAnchor)
        ])
        return root
    }

    private func makeMeetingRowCard(_ meeting: ScheduledMeeting) -> NSView {
        let card = NSView()
        card.wantsLayer = true
        card.layer?.backgroundColor = meetingCardBackground.cgColor
        card.layer?.cornerRadius = 13
        card.layer?.borderWidth = 1
        card.layer?.borderColor = NSColor.white.withAlphaComponent(0.06).cgColor
        card.translatesAutoresizingMaskIntoConstraints = false
        card.heightAnchor.constraint(equalToConstant: 116).isActive = true

        let dateFormatter = DateFormatter()
        dateFormatter.dateFormat = "EEE, MMM d"
        let timeFormatter = DateFormatter()
        timeFormatter.dateFormat = "h:mm a"
        let startText = timeFormatter.string(from: meeting.start)
        let endText = meeting.end.map { timeFormatter.string(from: $0) } ?? ""
        let range = endText.isEmpty ? startText : "\(startText) - \(endText)"

        let title = makeLabel(meeting.title, size: 26, color: primaryText, weight: .regular, centered: false)
        let detail = makeLabel("\(dateFormatter.string(from: meeting.start))\n\(range)", size: 14, color: secondaryText, weight: .regular, centered: false)
        detail.maximumNumberOfLines = 2
        let host = makeLabel("Host: \(meeting.host) • \(meeting.source)", size: 13, color: secondaryText, weight: .regular, centered: false)

        [title, detail, host].forEach {
            $0.translatesAutoresizingMaskIntoConstraints = false
            card.addSubview($0)
        }

        NSLayoutConstraint.activate([
            title.topAnchor.constraint(equalTo: card.topAnchor, constant: 11),
            title.leadingAnchor.constraint(equalTo: card.leadingAnchor, constant: 16),
            title.trailingAnchor.constraint(equalTo: card.trailingAnchor, constant: -14),

            detail.topAnchor.constraint(equalTo: title.bottomAnchor, constant: 3),
            detail.leadingAnchor.constraint(equalTo: title.leadingAnchor),
            detail.trailingAnchor.constraint(equalTo: title.trailingAnchor),

            host.topAnchor.constraint(equalTo: detail.bottomAnchor, constant: 7),
            host.leadingAnchor.constraint(equalTo: title.leadingAnchor),
            host.trailingAnchor.constraint(equalTo: title.trailingAnchor)
        ])

        return card
    }

    private func makeLabel(_ text: String, size: CGFloat, color: NSColor, weight: NSFont.Weight, centered: Bool) -> NSTextField {
        let label = NSTextField(labelWithString: text)
        label.font = .systemFont(ofSize: size, weight: weight)
        label.textColor = color
        label.alignment = centered ? .center : .left
        return label
    }

    private func makeSocialButton(icon: String, text: String, action: Selector? = nil) -> (container: NSView, button: NSButton?) {
        let wrapper = NSView()
        let button = NSButton(title: icon, target: action == nil ? nil : self, action: action)
        button.font = .systemFont(ofSize: 20, weight: .medium)
        button.isBordered = false
        button.wantsLayer = true
        button.layer?.cornerRadius = 12
        button.layer?.backgroundColor = cardBackground.cgColor
        button.contentTintColor = primaryText
        button.translatesAutoresizingMaskIntoConstraints = false

        let label = makeLabel(text, size: 12, color: secondaryText, weight: .regular, centered: true)
        label.translatesAutoresizingMaskIntoConstraints = false
        wrapper.addSubview(button)
        wrapper.addSubview(label)

        NSLayoutConstraint.activate([
            button.topAnchor.constraint(equalTo: wrapper.topAnchor),
            button.centerXAnchor.constraint(equalTo: wrapper.centerXAnchor),
            button.widthAnchor.constraint(equalToConstant: 52),
            button.heightAnchor.constraint(equalToConstant: 52),
            label.topAnchor.constraint(equalTo: button.bottomAnchor, constant: 6),
            label.centerXAnchor.constraint(equalTo: wrapper.centerXAnchor),
            label.bottomAnchor.constraint(equalTo: wrapper.bottomAnchor)
        ])
        return (wrapper, action == nil ? nil : button)
    }
}

struct GoogleOAuthTokens: Codable, Equatable {
    var accessToken: String
    var refreshToken: String?
    var expiresAt: Date
    var scope: String?
    var tokenType: String?
}

struct GoogleUserProfile: Codable, Equatable {
    var name: String?
    var email: String?
    var picture: String?
}

struct ZoomOAuthTokens: Codable, Equatable {
    var accessToken: String
    var refreshToken: String?
    var expiresAt: Date
    var scope: String?
    var tokenType: String?
}

enum ZoomOAuthError: Error {
    case missingClientId
    case missingClientSecret
    case invalidCallbackURL
    case missingAuthorizationCode
    case tokenExchangeFailed(String)
    case missingRequiredScope(String)
    case unableToOpenBrowser
    case authenticationTimedOut
}

final class ZoomOAuthTokenStore {
    private let defaultsKey: String
    private let defaults: UserDefaults

    init(service: String = Bundle.main.bundleIdentifier ?? "zoom_app",
         account: String = "zoomOAuthTokens",
         defaults: UserDefaults = .standard) {
        self.defaultsKey = "\(service).\(account)"
        self.defaults = defaults
    }

    func readTokens() throws -> ZoomOAuthTokens? {
        guard let data = defaults.data(forKey: defaultsKey) else { return nil }
        return try JSONDecoder().decode(ZoomOAuthTokens.self, from: data)
    }

    func writeTokens(_ tokens: ZoomOAuthTokens) throws {
        let data = try JSONEncoder().encode(tokens)
        defaults.set(data, forKey: defaultsKey)
    }

    func clearTokens() {
        defaults.removeObject(forKey: defaultsKey)
    }
}

final class ZoomOAuthService: NSObject {
    static let shared = ZoomOAuthService()

    private let tokenStore = ZoomOAuthTokenStore()
    private let clientIdDefaultsKey = "zoom.oauth.clientId"
    private let clientSecretDefaultsKey = "zoom.oauth.clientSecret"
    private let infoPlistClientIdKey = "ZoomOAuthClientId"
    private let envClientSecretKey = "ZOOM_OAUTH_CLIENT_SECRET"
    // Optional: put OAuth app credentials here for local-only testing (do not ship secrets in release builds).
    /// Fallback if Info.plist `ZoomOAuthClientId` is missing (e.g. mis-quoted build setting).
    private let bundledClientId = "isvIAKPhSPOhBxFUkiY2A"
    /// Prefer `ZOOM_OAUTH_CLIENT_SECRET` env or UserDefaults when distributing; rotate if this value is ever leaked.
    private let bundledClientSecret = "jPfbdvt14CKH48vKEg3NjDpTIgCd2rDq"

    func setClientCredentials(clientId: String, clientSecret: String) {
        UserDefaults.standard.set(clientId, forKey: clientIdDefaultsKey)
        UserDefaults.standard.set(clientSecret, forKey: clientSecretDefaultsKey)
    }

    func configuredClientId() -> String? {
        if let plist = Bundle.main.object(forInfoDictionaryKey: infoPlistClientIdKey) as? String {
            let trimmed = plist.trimmingCharacters(in: .whitespacesAndNewlines)
            if trimmed.isEmpty == false { return trimmed }
        }
        let value = UserDefaults.standard.string(forKey: clientIdDefaultsKey)?
            .trimmingCharacters(in: .whitespacesAndNewlines)
        if let value, value.isEmpty == false { return value }
        return bundledClientId.isEmpty ? nil : bundledClientId
    }

    func configuredClientSecret() -> String? {
        if let env = ProcessInfo.processInfo.environment[envClientSecretKey] {
            let trimmed = env.trimmingCharacters(in: .whitespacesAndNewlines)
            if trimmed.isEmpty == false { return trimmed }
        }
        let value = UserDefaults.standard.string(forKey: clientSecretDefaultsKey)?
            .trimmingCharacters(in: .whitespacesAndNewlines)
        if let value, value.isEmpty == false { return value }
        return bundledClientSecret.isEmpty ? nil : bundledClientSecret
    }

    func clearSavedTokens() {
        tokenStore.clearTokens()
    }

    func validAccessToken(presentingWindow: NSWindow?) async throws -> String {
        if let tokens = try tokenStore.readTokens(),
           tokens.expiresAt.timeIntervalSinceNow > 60,
           tokenHasRequiredScope(tokens.scope) {
            return tokens.accessToken
        } else if var tokens = try tokenStore.readTokens(),
                  let refreshed = try await refreshTokens(tokens) {
            tokens = refreshed
            try tokenStore.writeTokens(tokens)
            return tokens.accessToken
        }

        let tokens = try await interactiveSignIn(presentingWindow: presentingWindow)
        try tokenStore.writeTokens(tokens)
        return tokens.accessToken
    }

    private func interactiveSignIn(presentingWindow: NSWindow?) async throws -> ZoomOAuthTokens {
        _ = presentingWindow
        guard let clientId = configuredClientId() else { throw ZoomOAuthError.missingClientId }
        guard let clientSecret = configuredClientSecret() else { throw ZoomOAuthError.missingClientSecret }

        let loopback = try await OAuthLoopbackServer.start()
        defer { loopback.stop() }
        let redirectURI = loopback.redirectURI
        let state = UUID().uuidString

        var components = URLComponents(string: "https://zoom.us/oauth/authorize")!
        // Omit `scope` so Zoom uses the OAuth app’s enabled scopes from the Marketplace (avoids mismatch errors).
        components.queryItems = [
            URLQueryItem(name: "response_type", value: "code"),
            URLQueryItem(name: "client_id", value: clientId),
            URLQueryItem(name: "redirect_uri", value: redirectURI),
            URLQueryItem(name: "state", value: state)
        ]
        guard let authURL = components.url else { throw ZoomOAuthError.invalidCallbackURL }
        let opened = await MainActor.run { NSWorkspace.shared.open(authURL) }
        guard opened else { throw ZoomOAuthError.unableToOpenBrowser }

        let callbackURL = try await loopback.waitForCallback()
        let queryItems = URLComponents(url: callbackURL, resolvingAgainstBaseURL: false)?.queryItems
        guard queryItems?.first(where: { $0.name == "state" })?.value == state else { throw ZoomOAuthError.invalidCallbackURL }
        guard let code = queryItems?.first(where: { $0.name == "code" })?.value, code.isEmpty == false else {
            throw ZoomOAuthError.missingAuthorizationCode
        }

        return try await exchangeCodeForTokens(code: code, redirectURI: redirectURI, clientId: clientId, clientSecret: clientSecret)
    }

    private func exchangeCodeForTokens(code: String, redirectURI: String, clientId: String, clientSecret: String) async throws -> ZoomOAuthTokens {
        var request = URLRequest(url: URL(string: "https://zoom.us/oauth/token")!)
        request.httpMethod = "POST"
        request.setValue("application/x-www-form-urlencoded; charset=utf-8", forHTTPHeaderField: "Content-Type")
        request.setValue("Basic \(Self.basicAuth(clientId: clientId, clientSecret: clientSecret))", forHTTPHeaderField: "Authorization")
        request.httpBody = Self.formURLEncoded([
            "grant_type": "authorization_code",
            "code": code,
            "redirect_uri": redirectURI
        ])

        let (data, response) = try await URLSession.shared.data(for: request)
        guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
            throw ZoomOAuthError.tokenExchangeFailed(String(data: data, encoding: .utf8) ?? "Failed")
        }

        struct TokenResponse: Decodable {
            let access_token: String
            let refresh_token: String?
            let expires_in: Double
            let scope: String?
            let token_type: String?
        }

        let decoded = try JSONDecoder().decode(TokenResponse.self, from: data)
        return ZoomOAuthTokens(
            accessToken: decoded.access_token,
            refreshToken: decoded.refresh_token,
            expiresAt: Date().addingTimeInterval(decoded.expires_in),
            scope: decoded.scope,
            tokenType: decoded.token_type
        )
    }

    private func refreshTokens(_ tokens: ZoomOAuthTokens) async throws -> ZoomOAuthTokens? {
        guard let refreshToken = tokens.refreshToken else { return nil }
        guard let clientId = configuredClientId() else { throw ZoomOAuthError.missingClientId }
        guard let clientSecret = configuredClientSecret() else { throw ZoomOAuthError.missingClientSecret }

        var request = URLRequest(url: URL(string: "https://zoom.us/oauth/token")!)
        request.httpMethod = "POST"
        request.setValue("application/x-www-form-urlencoded; charset=utf-8", forHTTPHeaderField: "Content-Type")
        request.setValue("Basic \(Self.basicAuth(clientId: clientId, clientSecret: clientSecret))", forHTTPHeaderField: "Authorization")
        request.httpBody = Self.formURLEncoded([
            "grant_type": "refresh_token",
            "refresh_token": refreshToken
        ])

        let (data, response) = try await URLSession.shared.data(for: request)
        guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
            return nil
        }

        struct RefreshResponse: Decodable {
            let access_token: String
            let refresh_token: String?
            let expires_in: Double
            let scope: String?
            let token_type: String?
        }

        let decoded = try JSONDecoder().decode(RefreshResponse.self, from: data)
        return ZoomOAuthTokens(
            accessToken: decoded.access_token,
            refreshToken: decoded.refresh_token ?? refreshToken,
            expiresAt: Date().addingTimeInterval(decoded.expires_in),
            scope: decoded.scope ?? tokens.scope,
            tokenType: decoded.token_type ?? tokens.tokenType
        )
    }

    private func tokenHasRequiredScope(_ scopeValue: String?) -> Bool {
        guard let scopeValue, scopeValue.isEmpty == false else { return false }
        let parts = scopeValue.split { $0 == " " || $0 == "," }.map(String.init)
        return parts.contains { part in
            part == "meeting:read"
                || part == "meeting:read:admin"
                || part.contains("meeting:read")
                || part.contains("list_meetings")
                || part.contains("list_user_meetings")
        }
    }

    private static func basicAuth(clientId: String, clientSecret: String) -> String {
        let joined = "\(clientId):\(clientSecret)"
        return Data(joined.utf8).base64EncodedString()
    }

    private static func formURLEncoded(_ params: [String: String]) -> Data {
        let allowed = CharacterSet(charactersIn: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~")
        let pairs = params.map { key, value in
            let k = key.addingPercentEncoding(withAllowedCharacters: allowed) ?? key
            let v = value.addingPercentEncoding(withAllowedCharacters: allowed) ?? value
            return "\(k)=\(v)"
        }.joined(separator: "&")
        return Data(pairs.utf8)
    }
}

enum GoogleOAuthError: Error {
    case missingClientId
    case missingClientSecret
    case invalidCallbackURL
    case missingAuthorizationCode
    case tokenExchangeFailed(String)
    case unableToOpenBrowser
    case authenticationTimedOut
}

final class GoogleOAuthService: NSObject {
    static let shared = GoogleOAuthService()
    private var inAppOAuthWindowController: InAppOAuthWindowController?
    private let clientId = "1058191714408-i7dlicarppj0rt0ghn9loou606lmm0dr.apps.googleusercontent.com"
    private let clientSecret = "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"
    private let requiredCalendarScope = "https://www.googleapis.com/auth/calendar.readonly"
    private let scopes = ["openid", "email", "profile", "https://www.googleapis.com/auth/calendar.readonly"]
    private lazy var tokenStore = KeychainTokenStore(account: "googleOAuthTokens.\(clientId)")

    func loadTokens() -> GoogleOAuthTokens? { try? tokenStore.readTokens() }

    func clearSavedTokens() {
        tokenStore.clearTokens()
    }

    func fetchUserProfile(accessToken: String) async throws -> GoogleUserProfile {
        var request = URLRequest(url: URL(string: "https://openidconnect.googleapis.com/v1/userinfo")!)
        request.httpMethod = "GET"
        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
        let (data, response) = try await URLSession.shared.data(for: request)
        guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
            throw GoogleOAuthError.tokenExchangeFailed(String(data: data, encoding: .utf8) ?? "Failed")
        }
        return try JSONDecoder().decode(GoogleUserProfile.self, from: data)
    }

    func validAccessToken(presentingWindow: NSWindow?) async throws -> String {
        if let tokens = try tokenStore.readTokens(),
           tokens.expiresAt.timeIntervalSinceNow > 60,
           tokenHasCalendarScope(tokens.scope) {
            return tokens.accessToken
        }
        let tokens = try await interactiveSignIn(presentingWindow: presentingWindow)
        try tokenStore.writeTokens(tokens)
        return tokens.accessToken
    }

    private func interactiveSignIn(presentingWindow: NSWindow?) async throws -> GoogleOAuthTokens {
        _ = presentingWindow
        let codeVerifier = Self.randomURLSafeString(length: 64)
        let codeChallenge = Self.pkceChallenge(for: codeVerifier)
        let state = Self.randomURLSafeString(length: 32)
        let loopback = try await OAuthLoopbackServer.start()
        defer { loopback.stop() }
        let redirectURI = loopback.redirectURI

        var components = URLComponents(string: "https://accounts.google.com/o/oauth2/v2/auth")!
        components.queryItems = [
            URLQueryItem(name: "client_id", value: clientId),
            URLQueryItem(name: "redirect_uri", value: redirectURI),
            URLQueryItem(name: "response_type", value: "code"),
            URLQueryItem(name: "scope", value: scopes.joined(separator: " ")),
            URLQueryItem(name: "state", value: state),
            URLQueryItem(name: "code_challenge", value: codeChallenge),
            URLQueryItem(name: "code_challenge_method", value: "S256"),
            URLQueryItem(name: "access_type", value: "offline"),
            URLQueryItem(name: "prompt", value: "consent")
        ]

        guard let authURL = components.url else { throw GoogleOAuthError.invalidCallbackURL }
        let opened = await MainActor.run { NSWorkspace.shared.open(authURL) }
        guard opened else { throw GoogleOAuthError.unableToOpenBrowser }

        let callbackURL = try await loopback.waitForCallback()
        let query = URLComponents(url: callbackURL, resolvingAgainstBaseURL: false)?.queryItems
        guard query?.first(where: { $0.name == "state" })?.value == state else { throw GoogleOAuthError.invalidCallbackURL }
        guard let code = query?.first(where: { $0.name == "code" })?.value, code.isEmpty == false else {
            throw GoogleOAuthError.missingAuthorizationCode
        }
        return try await exchangeCodeForTokens(code: code, codeVerifier: codeVerifier, redirectURI: redirectURI)
    }

    private func exchangeCodeForTokens(code: String, codeVerifier: String, redirectURI: String) async throws -> GoogleOAuthTokens {
        var request = URLRequest(url: URL(string: "https://oauth2.googleapis.com/token")!)
        request.httpMethod = "POST"
        request.setValue("application/x-www-form-urlencoded; charset=utf-8", forHTTPHeaderField: "Content-Type")
        request.httpBody = Self.formURLEncoded([
            "client_id": clientId,
            "client_secret": clientSecret,
            "code": code,
            "code_verifier": codeVerifier,
            "redirect_uri": redirectURI,
            "grant_type": "authorization_code"
        ])
        let (data, response) = try await URLSession.shared.data(for: request)
        guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
            throw GoogleOAuthError.tokenExchangeFailed(String(data: data, encoding: .utf8) ?? "Failed")
        }

        struct TokenResponse: Decodable {
            let access_token: String
            let expires_in: Double
            let refresh_token: String?
            let scope: String?
            let token_type: String?
        }

        let decoded = try JSONDecoder().decode(TokenResponse.self, from: data)
        return GoogleOAuthTokens(
            accessToken: decoded.access_token,
            refreshToken: decoded.refresh_token,
            expiresAt: Date().addingTimeInterval(decoded.expires_in),
            scope: decoded.scope,
            tokenType: decoded.token_type
        )
    }

    private static func pkceChallenge(for verifier: String) -> String {
        let digest = SHA256.hash(data: Data(verifier.utf8))
        return Data(digest).base64URLEncodedString()
    }

    private static func randomURLSafeString(length: Int) -> String {
        var bytes = [UInt8](repeating: 0, count: length)
        _ = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)
        return Data(bytes).base64URLEncodedString()
    }

    private static func formURLEncoded(_ params: [String: String]) -> Data {
        let allowed = CharacterSet(charactersIn: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~")
        let pairs = params.map { key, value in
            let k = key.addingPercentEncoding(withAllowedCharacters: allowed) ?? key
            let v = value.addingPercentEncoding(withAllowedCharacters: allowed) ?? value
            return "\(k)=\(v)"
        }.joined(separator: "&")
        return Data(pairs.utf8)
    }

    private func tokenHasCalendarScope(_ scopeValue: String?) -> Bool {
        guard let scopeValue else { return false }
        return scopeValue.split(separator: " ").contains(where: { $0 == Substring(requiredCalendarScope) })
    }
}

private extension Data {
    func base64URLEncodedString() -> String {
        base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
    }
}

final class KeychainTokenStore {
    private let defaultsKey: String
    private let defaults: UserDefaults

    init(service: String = Bundle.main.bundleIdentifier ?? "zoom_app",
         account: String = "googleOAuthTokens",
         defaults: UserDefaults = .standard) {
        self.defaultsKey = "\(service).\(account)"
        self.defaults = defaults
    }

    func readTokens() throws -> GoogleOAuthTokens? {
        guard let data = defaults.data(forKey: defaultsKey) else { return nil }
        return try JSONDecoder().decode(GoogleOAuthTokens.self, from: data)
    }

    func writeTokens(_ tokens: GoogleOAuthTokens) throws {
        let data = try JSONEncoder().encode(tokens)
        defaults.set(data, forKey: defaultsKey)
    }

    func clearTokens() {
        defaults.removeObject(forKey: defaultsKey)
    }
}

private final class OAuthLoopbackServer {
    /// Fixed port so Zoom/Google OAuth redirect URLs can be registered exactly (Zoom allow list does not support wildcards for ports).
    private static let loopbackOAuthPort: UInt16 = 8742

    private let queue = DispatchQueue(label: "google.oauth.loopback.server")
    private let listener: NWListener
    private var readyContinuation: CheckedContinuation<Void, Error>?
    private var callbackContinuation: CheckedContinuation<URL, Error>?
    private var callbackURL: URL?

    private init(listener: NWListener) {
        self.listener = listener
    }

    static func start() async throws -> OAuthLoopbackServer {
        guard let port = NWEndpoint.Port(rawValue: loopbackOAuthPort) else {
            throw GoogleOAuthError.invalidCallbackURL
        }
        let listener = try NWListener(using: .tcp, on: port)
        let server = OAuthLoopbackServer(listener: listener)
        try await server.startListening()
        return server
    }

    var redirectURI: String {
        let port = listener.port?.rawValue ?? 0
        return "http://127.0.0.1:\(port)/oauth2redirect"
    }

    func waitForCallback(timeoutSeconds: Double = 120) async throws -> URL {
        try await withThrowingTaskGroup(of: URL.self) { group in
            group.addTask { [weak self] in
                guard let self else { throw GoogleOAuthError.invalidCallbackURL }
                return try await self.awaitCallback()
            }
            group.addTask {
                try await Task.sleep(nanoseconds: UInt64(timeoutSeconds * 1_000_000_000))
                throw GoogleOAuthError.authenticationTimedOut
            }
            let url = try await group.next()!
            group.cancelAll()
            return url
        }
    }

    func stop() {
        listener.cancel()
    }

    private func startListening() async throws {
        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, Error>) in
            queue.async {
                self.readyContinuation = continuation
                self.listener.stateUpdateHandler = { [weak self] state in
                    guard let self else { return }
                    switch state {
                    case .ready:
                        if let readyContinuation = self.readyContinuation {
                            self.readyContinuation = nil
                            readyContinuation.resume()
                        }
                    case .failed(let error):
                        if let readyContinuation = self.readyContinuation {
                            self.readyContinuation = nil
                            readyContinuation.resume(throwing: error)
                        }
                    case .cancelled:
                        if let readyContinuation = self.readyContinuation {
                            self.readyContinuation = nil
                            readyContinuation.resume(throwing: GoogleOAuthError.invalidCallbackURL)
                        }
                    default:
                        break
                    }
                }
                self.listener.newConnectionHandler = { [weak self] connection in
                    self?.handle(connection: connection)
                }
                self.listener.start(queue: self.queue)
            }
        }
    }

    private func awaitCallback() async throws -> URL {
        if let callbackURL { return callbackURL }
        return try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<URL, Error>) in
            queue.async { self.callbackContinuation = continuation }
        }
    }

    private func handle(connection: NWConnection) {
        connection.start(queue: queue)
        connection.receive(minimumIncompleteLength: 1, maximumLength: 8192) { [weak self] data, _, _, _ in
            guard let self else { return }
            let requestLine = data.flatMap { String(data: $0, encoding: .utf8) }?.split(separator: "\r\n").first.map(String.init)
            var parsedURL: URL?
            if let requestLine {
                let parts = requestLine.split(separator: " ")
                if parts.count >= 2 {
                    parsedURL = URL(string: "http://127.0.0.1\(parts[1])")
                }
            }
            self.sendHTTPResponse(connection: connection, success: parsedURL != nil)
            if let parsedURL {
                self.callbackURL = parsedURL
                self.callbackContinuation?.resume(returning: parsedURL)
                self.callbackContinuation = nil
                self.listener.cancel()
            }
            connection.cancel()
        }
    }

    private func sendHTTPResponse(connection: NWConnection, success: Bool) {
        let body = success ? "<html><body><h3>Authentication complete</h3><p>You can return to the app.</p></body></html>" : "<html><body><h3>Authentication failed</h3></body></html>"
        let response = "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: \(body.utf8.count)\r\nConnection: close\r\n\r\n\(body)"
        connection.send(content: Data(response.utf8), completion: .contentProcessed { _ in })
    }
}

@MainActor
private final class OAuthWebViewContainerView: NSView {
    private let webView: WKWebView
    init(webView: WKWebView) {
        self.webView = webView
        super.init(frame: .zero)
        addSubview(webView)
    }
    @available(*, unavailable) required init?(coder: NSCoder) { nil }
    override func layout() {
        super.layout()
        webView.frame = bounds
    }
}

@MainActor
private final class InAppOAuthWindowController: NSWindowController {
    private let webView: WKWebView
    init() {
        self.webView = WKWebView(frame: .zero, configuration: WKWebViewConfiguration())
        let container = OAuthWebViewContainerView(webView: webView)
        let window = NSWindow(contentRect: NSRect(x: 0, y: 0, width: 980, height: 760), styleMask: [.titled, .closable, .miniaturizable, .resizable], backing: .buffered, defer: false)
        window.title = "Google Sign-In"
        window.contentView = container
        super.init(window: window)
    }
    @available(*, unavailable) required init?(coder: NSCoder) { nil }
    func load(url: URL) { webView.load(URLRequest(url: url)) }
}

extension GoogleOAuthError: LocalizedError {
    var errorDescription: String? {
        switch self {
        case .missingClientId: return "Missing Google OAuth Client ID."
        case .missingClientSecret: return "Missing Google OAuth Client Secret."
        case .invalidCallbackURL: return "Invalid OAuth callback URL."
        case .missingAuthorizationCode: return "Google did not return an authorization code."
        case .tokenExchangeFailed(let details): return "Token exchange failed: \(details)"
        case .unableToOpenBrowser: return "Could not open browser for Google sign-in."
        case .authenticationTimedOut: return "Google sign-in timed out."
        }
    }
}

extension ZoomOAuthError: LocalizedError {
    var errorDescription: String? {
        switch self {
        case .missingClientId:
            return "Zoom OAuth Client ID is not set (Info.plist ZoomOAuthClientId, UserDefaults, or the setup prompt)."
        case .missingClientSecret:
            return "Zoom OAuth Client Secret is not set (environment ZOOM_OAUTH_CLIENT_SECRET, UserDefaults, or the setup prompt)."
        case .invalidCallbackURL:
            return "The OAuth redirect URL was invalid. In your Zoom app OAuth allow list, add exactly http://127.0.0.1:8742/oauth2redirect (must match OAuthLoopbackServer.loopbackOAuthPort in this target)."
        case .missingAuthorizationCode:
            return "Zoom did not return an authorization code."
        case .tokenExchangeFailed(let details):
            return details
        case .missingRequiredScope(let details):
            return "The Zoom access token is missing required scopes. \(details)"
        case .unableToOpenBrowser:
            return "Could not open the system browser for Zoom sign-in."
        case .authenticationTimedOut:
            return "Zoom sign-in timed out waiting for the browser redirect."
        }
    }
}