import {

  createHash,

  randomBytes,

  scryptSync,

  timingSafeEqual,

} from "node:crypto";

import { and, eq, gt } from "drizzle-orm";

import { sessions, users, type Database } from "@stepping/db";

import type { UserRole } from "@stepping/types";

const SESSION_DAYS = 30;

export const SESSION_COOKIE = "sid";

export function hashPassword(pw: string): string {

  const salt = randomBytes(16).toString("hex");

  const hash = scryptSync(pw, salt, 64).toString("hex");

  return `scrypt$${salt}$${hash}`;

}

export function verifyPassword(pw: string, stored: string | null | undefined): boolean {

  if (!stored) return false;

  const [scheme, salt, hash] = stored.split("$");

  if (scheme !== "scrypt" || !salt || !hash) return false;

  const test = scryptSync(pw, salt, 64);

  const ref = Buffer.from(hash, "hex");

  return test.length === ref.length && timingSafeEqual(test, ref);

}

function hashToken(token: string): string {

  return createHash("sha256").update(token).digest("hex");

}

export async function createSession(

  db: Database,

  userId: string,

): Promise<{ token: string; expiresAt: Date }> {

  const token = randomBytes(32).toString("hex");

  const expiresAt = new Date(Date.now() + SESSION_DAYS * 86_400_000);

  await db.insert(sessions).values({ tokenHash: hashToken(token), userId, expiresAt });

  return { token, expiresAt };

}

export async function verifyCredentials(

  db: Database,

  email: string,

  password: string,

): Promise<string | null> {

  const [u] = await db

    .select({ id: users.id, passwordHash: users.passwordHash })

    .from(users)

    .where(eq(users.email, email.trim().toLowerCase()));

  if (!u || !verifyPassword(password, u.passwordHash)) return null;

  return u.id;

}

export interface SessionUser {

  id: string;

  role: UserRole;

}

export async function validateSession(

  db: Database,

  token: string | undefined | null,

): Promise<SessionUser | null> {

  if (!token) return null;

  const [row] = await db

    .select({ id: users.id, role: users.role, expiresAt: sessions.expiresAt })

    .from(sessions)

    .innerJoin(users, eq(users.id, sessions.userId))

    .where(

      and(eq(sessions.tokenHash, hashToken(token)), gt(sessions.expiresAt, new Date())),

    );

  return row ? { id: row.id, role: row.role } : null;

}

export async function destroySession(

  db: Database,

  token: string | undefined | null,

): Promise<void> {

  if (!token) return;

  await db.delete(sessions).where(eq(sessions.tokenHash, hashToken(token)));

}

export function readSessionCookie(cookieHeader: string | null | undefined): string | null {

  if (!cookieHeader) return null;

  for (const part of cookieHeader.split(";")) {

    const [k, ...v] = part.trim().split("=");

    if (k === SESSION_COOKIE) return decodeURIComponent(v.join("="));

  }

  return null;

}