import { createHash, randomBytes } from "node:crypto";
import { prisma } from "@/lib/prisma";
import { personalTokenScope, USER_TOKENABLE_TYPE } from "@/lib/auth/personal-token-scope";
import { databaseUserId } from "@/lib/auth/session-user";

/**
 * Bearer-token auth for the public REST API, backed by personal_access_tokens
 * (the Laravel Sanctum table that already exists in the emulator DB). Tokens are
 * stored as the sha256 of the plaintext; the client sends the plaintext (or the
 * Sanctum "{id}|{plaintext}" form) as `Authorization: Bearer …`.
 */
function hashToken(raw: string): string {
  return createHash("sha256").update(raw).digest("hex");
}

/** Resolve the user id behind a Bearer token, or null. */
export async function bearerUserId(req: Request): Promise<number | null> {
  const header = req.headers.get("authorization") ?? "";
  const m = header.match(/^Bearer\s+(.+)$/i);
  if (!m) return null;
  let raw = m[1].trim();
  const pipe = raw.indexOf("|");
  if (pipe >= 0) raw = raw.slice(pipe + 1); // Sanctum "{id}|{token}"
  if (!raw) return null;

  try {
    const row = await prisma.personalAccessTokens.findFirst({
      where: {
        token: hashToken(raw),
        OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
      },
      select: { id: true, tokenableId: true },
    });
    if (!row) return null;
    // Best-effort last-used stamp (don't fail the request if it errors).
    prisma.personalAccessTokens
      .update({ where: { id: row.id }, data: { lastUsedAt: new Date() }, select: { id: true } })
      .catch(() => {});
    return databaseUserId(row.tokenableId);
  } catch {
    return null;
  }
}

/** Mint a new token for a user. Returns the plaintext (shown once). */
export async function issueToken(userId: number, name = "api"): Promise<string | null> {
  const plaintext = randomBytes(32).toString("hex");
  try {
    await prisma.personalAccessTokens.create({
      data: {
        ...personalTokenScope(userId),
        name: name.slice(0, 100),
        token: hashToken(plaintext),
        abilities: '["*"]',
        createdAt: new Date(),
        updatedAt: new Date(),
      },
      select: { id: true },
    });
    return plaintext;
  } catch {
    return null;
  }
}