import { randomBytes } from "node:crypto";
import type { FastifyReply, FastifyRequest } from "fastify";
import type { Role } from "@parking/shared";

// Local JWT auth helpers — fully local, no external identity provider
// (offline-first). The JWT is carried in an HttpOnly cookie (JS can't read it);
// a separate readable CSRF cookie + matching header defends mutations
// (double-submit). See wiki/entities/local-jwt-auth.md.

declare module "@fastify/jwt" {
  interface FastifyJWT {
    payload: { sub: string; username: string; role: Role; csrf: string };
    user: { sub: string; username: string; role: Role; csrf: string };
  }
}

export const TOKEN_COOKIE = "parking_token";
export const CSRF_COOKIE = "parking_csrf";
export const CSRF_HEADER = "x-csrf-token";

// Session lifetime: the JWT has NO expiry — a login is valid until explicit
// logout. Booth reality breaks any fixed clock (relief late/absent, forced double
// shifts), and a shift is a separate explicit boundary, not the token's lifetime.
// See wiki/entities/local-jwt-auth.md + wiki/concepts/shift.md.
//
// The cookie still needs a maxAge so it survives a browser restart (a session
// cookie would log out an active operator on browser close — the opposite of
// "until logout"). Use a long fixed window; the server clears it on logout.
export const COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60; // 30 days

/**
 * Resolve the JWT signing secret, refusing to start without a strong one.
 * There is deliberately no fallback default — a missing, short, or placeholder
 * secret throws so the server never runs with forgeable tokens.
 */
export function requireJwtSecret(): string {
  const secret = process.env.JWT_SECRET;
  if (!secret || secret.length < 32 || /change.?me|insecure|dev-only/i.test(secret)) {
    throw new Error(
      "JWT_SECRET must be set to a strong random value (>=32 chars). " +
        "Generate one with: openssl rand -hex 32",
    );
  }
  return secret;
}

/** Cookies are secure in production; relaxed for local http dev. */
function secureCookies(): boolean {
  return process.env.NODE_ENV === "production";
}

export function newCsrfToken(): string {
  return randomBytes(32).toString("hex");
}

/** Set the auth (HttpOnly) + CSRF (readable) cookies after a successful login. */
export function setAuthCookies(reply: FastifyReply, jwt: string, csrf: string): void {
  const secure = secureCookies();
  reply.setCookie(TOKEN_COOKIE, jwt, {
    httpOnly: true,
    sameSite: "strict",
    secure,
    path: "/",
    maxAge: COOKIE_MAX_AGE_SECONDS,
  });
  // Readable by JS so the SPA can echo it back in the CSRF header (double-submit).
  reply.setCookie(CSRF_COOKIE, csrf, {
    httpOnly: false,
    sameSite: "strict",
    secure,
    path: "/",
    maxAge: COOKIE_MAX_AGE_SECONDS,
  });
}

export function clearAuthCookies(reply: FastifyReply): void {
  reply.clearCookie(TOKEN_COOKIE, { path: "/" });
  reply.clearCookie(CSRF_COOKIE, { path: "/" });
}

const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);

/**
 * Double-submit CSRF check: the X-CSRF-Token header must match the CSRF cookie.
 * The CSRF token is bound into the JWT at login, so a stolen/forged cookie pair
 * still can't pass unless it matches the signed token. Only enforced on
 * state-changing methods (safe reads are exempt).
 */
function assertCsrf(req: FastifyRequest): void {
  if (!MUTATING.has(req.method)) return;
  const header = req.headers[CSRF_HEADER];
  const cookie = req.cookies[CSRF_COOKIE];
  const tokenCsrf = (req.user as { csrf?: string } | undefined)?.csrf;
  if (!header || !cookie || header !== cookie || (tokenCsrf && header !== tokenCsrf)) {
    throw Object.assign(new Error("invalid CSRF token"), { statusCode: 403 });
  }
}

/**
 * preHandler role guard. Verifies the JWT (from the HttpOnly cookie), enforces
 * CSRF on mutations, then checks the role. Authorization is a simple per-route
 * role check — no Casbin/RBAC engine needed at this scale.
 */
export function requireRole(...allowed: Role[]) {
  return async (req: FastifyRequest, _reply: FastifyReply) => {
    await req.jwtVerify(); // reads the token cookie (configured in server.ts)
    assertCsrf(req);
    if (!req.user || !allowed.includes(req.user.role)) {
      throw Object.assign(new Error("forbidden"), { statusCode: 403 });
    }
  };
}