import "server-only";

import { randomUUID } from "node:crypto";
import { serverEnv } from "@/lib/server/env";
import {
  createSession,
  createUser,
  deleteSessionById,
  findSessionWithUser,
  findUserByUsername,
  findUserWithTotpByUsername,
} from "@/lib/server/modules/auth/repository";
import { hashPassword, verifyPassword } from "@/lib/server/modules/auth/password";
import { createPartialAuthToken } from "@/lib/server/modules/auth/partial-auth-token";
import {
  createSessionToken,
  verifySessionToken,
} from "@/lib/server/modules/auth/session-token";

export class AuthError extends Error {
  constructor(
    message: string,
    public readonly statusCode: number,
  ) {
    super(message);
    this.name = "AuthError";
  }
}

/**
 * Equal-time defence for the user-not-found branch of {@link loginUser}.
 * Without this, the response time on an unknown username is noticeably
 * shorter (one DB miss, no scrypt) than on a known one (DB hit plus a full
 * password verification), letting an attacker enumerate valid usernames.
 *
 * Computed once at module load so first-call latency stays in line with
 * subsequent calls; the verifyPassword on the miss path then re-runs scrypt
 * against this fixed hash for the same shape of work as a real check.
 */
const DUMMY_PASSWORD_HASH_PROMISE: Promise<string> = hashPassword(
  "__nonexistent_user_password__",
);
DUMMY_PASSWORD_HASH_PROMISE.catch(() => {
  // Swallow to prevent an unhandled rejection if scrypt ever throws at
  // import time; loginUser awaits the same promise and will surface it.
});

function normalizeUsername(username: string) {
  return username.trim().toLowerCase();
}

function validateUsername(username: string) {
  const normalized = normalizeUsername(username);
  if (!/^[a-z0-9_-]{3,32}$/.test(normalized)) {
    throw new AuthError(
      "Username must be 3-32 chars and use only lowercase letters, numbers, underscore, or dash",
      400,
    );
  }

  return normalized;
}

function validatePassword(password: string) {
  if (password.length < 8) {
    throw new AuthError("Password must be at least 8 characters", 400);
  }
}

function getSessionExpiryDate() {
  return new Date(Date.now() + serverEnv.AUTH_SESSION_HOURS * 60 * 60 * 1000);
}

export async function registerUser(params: {
  username: string;
  password: string;
  confirmPassword: string;
}) {
  const username = validateUsername(params.username);
  validatePassword(params.password);

  if (params.password !== params.confirmPassword) {
    throw new AuthError("Password confirmation does not match", 400);
  }

  const existingUser = await findUserByUsername(username);
  if (existingUser) {
    throw new AuthError("Username is already registered", 409);
  }

  const userId = randomUUID();
  const passwordHash = await hashPassword(params.password);

  await createUser({
    id: userId,
    username,
    passwordHash,
  });

  return {
    id: userId,
    username,
  };
}

export type LoginResult =
  | {
      kind: "session";
      token: string;
      expiresAt: Date;
      user: { id: string; username: string };
    }
  | {
      kind: "partial";
      partialAuthToken: string;
      partialAuthExpiresAt: Date;
      user: { id: string; username: string };
    };

export async function loginUser(params: {
  username: string;
  password: string;
}): Promise<LoginResult> {
  const username = normalizeUsername(params.username);

  const user = await findUserWithTotpByUsername(username);

  if (!user) {
    // Run a full scrypt verification against a fixed dummy hash so the miss
    // path takes the same wall-clock time as the user-exists / wrong-password
    // path. Without this the timing delta leaks username existence.
    const dummyHash = await DUMMY_PASSWORD_HASH_PROMISE;
    await verifyPassword(params.password, dummyHash);
    throw new AuthError("Invalid username or password", 401);
  }

  const isPasswordValid = await verifyPassword(params.password, user.passwordHash);

  if (!isPasswordValid) {
    throw new AuthError("Invalid username or password", 401);
  }

  if (user.totpEnabled) {
    // Password verified but the user has 2FA on — issue a stateless,
    // short-lived partial-auth token instead of a full session. The caller
    // must complete A8 to convert it into a real session cookie.
    const { token, expiresAtEpochSeconds } = createPartialAuthToken(user.id);
    return {
      kind: "partial",
      partialAuthToken: token,
      partialAuthExpiresAt: new Date(expiresAtEpochSeconds * 1000),
      user: {
        id: user.id,
        username: user.username,
      },
    };
  }

  const expiresAt = getSessionExpiryDate();
  const sessionId = randomUUID();

  await createSession({
    id: sessionId,
    userId: user.id,
    expiresAt,
  });

  const token = createSessionToken(
    sessionId,
    Math.floor(expiresAt.getTime() / 1000),
  );

  return {
    kind: "session",
    token,
    expiresAt,
    user: {
      id: user.id,
      username: user.username,
    },
  };
}

export async function logoutSession(sessionToken: string | null | undefined) {
  if (!sessionToken) return;

  const verified = verifySessionToken(sessionToken);
  if (!verified) return;

  await deleteSessionById(verified.sessionId);
}

export async function authenticateSession(sessionToken: string | null | undefined) {
  if (!sessionToken) return null;

  const verified = verifySessionToken(sessionToken);
  if (!verified) return null;

  const session = await findSessionWithUser(verified.sessionId);
  if (!session) return null;

  return {
    sessionId: session.sessionId,
    userId: session.userId,
    username: session.username,
    passwordHash: session.passwordHash,
    expiresAt: session.expiresAt,
  };
}

export async function verifyUnlockPassword(params: {
  sessionToken: string | null | undefined;
  password: string;
}) {
  const session = await authenticateSession(params.sessionToken);
  if (!session) {
    throw new AuthError("Unauthorized", 401);
  }

  const isPasswordValid = await verifyPassword(
    params.password,
    session.passwordHash,
  );

  if (!isPasswordValid) {
    throw new AuthError("Invalid password", 401);
  }

  return {
    userId: session.userId,
    username: session.username,
  };
}