from __future__ import annotations

import base64

import hashlib

from datetime import datetime, timedelta, timezone

from typing import Any

import bcrypt

from jose import jwt

from app.core.config import settings

def _prehash(plain: str) -> bytes:

    """bcrypt silently truncates at 72 bytes (and bcrypt>=4.1 raises). Pre-hash with SHA-256

    and base64-encode so passwords of any length are fully mixed into a fixed 44-byte input."""

    digest = hashlib.sha256(plain.encode("utf-8")).digest()

    return base64.b64encode(digest)

def hash_password(plain: str) -> str:

    return bcrypt.hashpw(_prehash(plain), bcrypt.gensalt()).decode("utf-8")

def verify_password(plain: str, hashed: str) -> bool:

    try:

        return bcrypt.checkpw(_prehash(plain), hashed.encode("utf-8"))

    except (ValueError, TypeError):

        return False

def create_access_token(subject: str, role: str, extra: dict[str, Any] | None = None) -> str:

    now = datetime.now(timezone.utc)

    payload: dict[str, Any] = {

        "sub": subject,

        "role": role,

        "iat": now,

        "exp": now + timedelta(minutes=settings.access_token_expire_minutes),

    }

    if extra:

        payload.update(extra)

    return jwt.encode(payload, settings.secret_key, algorithm=settings.jwt_algorithm)

def decode_token(token: str) -> dict[str, Any]:

    return jwt.decode(token, settings.secret_key, algorithms=[settings.jwt_algorithm])

def generate_api_key() -> tuple[str, str]:

    """Return (plaintext, sha256). Plaintext is shown to the user once; only the hash is stored.

    Prefix `sk_` makes the key recognizable in logs/leak scanners."""

    import secrets

    raw = "sk_" + secrets.token_urlsafe(32)

    return raw, hash_api_key(raw)

def hash_api_key(raw: str) -> str:

    return hashlib.sha256(raw.encode("utf-8")).hexdigest()