import 'server-only';
import { createHmac, timingSafeEqual } from 'crypto';
import { cookies } from 'next/headers';
import {
  ADMIN_COOKIE,
  ADMIN_PASSWORD,
  SESSION_MAX_AGE,
  SESSION_SECRET,
  isSupabaseConfigured,
} from './env';
import { supabaseServer } from './supabase';

/* ---------------------------------------------------------------------
   Imzali oturum cerezi.

   Cerez degeri:  <sonKullanmaZamani>.<hmacImzasi>
   Imza sunucudaki SESSION_SECRET ile uretilir; anahtari bilmeyen biri
   gecerli bir cerez uretemez. Boylece tarayicidan elle cerez ekleyerek
   panele girmek mumkun degildir.
   --------------------------------------------------------------------- */

function sign(payload: string): string {
  return createHmac('sha256', SESSION_SECRET).update(payload).digest('base64url');
}

function createToken(): string {
  const expiresAt = Date.now() + SESSION_MAX_AGE * 1000;
  return `${expiresAt}.${sign(String(expiresAt))}`;
}

function verifyToken(token: string | undefined): boolean {
  if (!token || !SESSION_SECRET) return false;
  const dot = token.lastIndexOf('.');
  if (dot < 1) return false;

  const expiresAt = token.slice(0, dot);
  const signature = token.slice(dot + 1);
  if (!/^\d+$/.test(expiresAt)) return false;
  if (Number(expiresAt) < Date.now()) return false;

  const expected = Buffer.from(sign(expiresAt));
  const received = Buffer.from(signature);
  if (expected.length !== received.length) return false;
  return timingSafeEqual(expected, received);
}

async function setSessionCookie(token: string) {
  const store = await cookies();
  store.set(ADMIN_COOKIE, token, {
    httpOnly: true,
    sameSite: 'lax',
    path: '/',
    maxAge: SESSION_MAX_AGE,
    secure: process.env.NODE_ENV === 'production',
  });
}

/* ------------------------------ genel API ---------------------------- */

/** Panele giris yapilmis mi? Supabase modunda Supabase Auth kullanilir. */
export async function isAuthenticated(): Promise<boolean> {
  if (isSupabaseConfigured()) {
    const sb = await supabaseServer();
    const { data } = await sb.auth.getUser();
    return Boolean(data.user);
  }
  const store = await cookies();
  return verifyToken(store.get(ADMIN_COOKIE)?.value);
}

export type SignInResult = { ok: true } | { ok: false; error: string };

/** Zamanlama saldirilarina karsi sabit sureli sifre karsilastirmasi. */
function passwordMatches(input: string): boolean {
  const a = createHmac('sha256', SESSION_SECRET || 'x').update(input).digest();
  const b = createHmac('sha256', SESSION_SECRET || 'x').update(ADMIN_PASSWORD).digest();
  return a.length === b.length && timingSafeEqual(a, b);
}

export async function signIn(email: string, password: string): Promise<SignInResult> {
  if (isSupabaseConfigured()) {
    const sb = await supabaseServer();
    const { error } = await sb.auth.signInWithPassword({ email, password });
    if (error) return { ok: false, error: 'E-posta veya şifre hatalı.' };
    return { ok: true };
  }

  if (!SESSION_SECRET) {
    return {
      ok: false,
      error: 'Sunucu yapılandırması eksik: SESSION_SECRET tanımlanmamış.',
    };
  }

  if (passwordMatches(password)) {
    await setSessionCookie(createToken());
    return { ok: true };
  }
  return { ok: false, error: 'Şifre hatalı.' };
}

export async function signOut(): Promise<void> {
  if (isSupabaseConfigured()) {
    const sb = await supabaseServer();
    await sb.auth.signOut();
    return;
  }
  const store = await cookies();
  store.delete(ADMIN_COOKIE);
}