use std::time::Duration;

use crate::cache::Cache;
use crate::config::pow::PowConfig;
use crate::session::Session;

use crate::errors::{AuthError, AuthResult};
use crate::handlers::challenge::{ChallengeResponse, PowProofRequest, SESSION_CHALLENGE};
use crate::share::crypto::{now_secs, random_alnum};

pub const USED_KEY_PREFIX: &str = "auth:pow:used:";

pub async fn issue(session: &Session, config: &PowConfig) -> AuthResult<ChallengeResponse> {
    let now = now_secs();
    let challenge = ChallengeResponse {
        context: random_alnum(32),
        difficulty: config.difficulty,
        issued_at: now,
        expires_at: now + config.expires_secs,
    };

    session.set(SESSION_CHALLENGE, &challenge)?;

    Ok(challenge)
}

pub async fn verify(
    session: &Session,
    cache: &Cache,
    proof: &PowProofRequest,
    expected_payload: &[u8],
) -> AuthResult<()> {
    let challenge = session
        .get::<ChallengeResponse>(SESSION_CHALLENGE)?
        .ok_or(AuthError::Expired)?;

    crate::pow::hash::verify_pow(&challenge, proof, expected_payload)?;

    let remaining = challenge.expires_at.saturating_sub(now_secs()).max(1);
    let used_key = used_key(&challenge.context);
    let claimed = cache
        .set_nx_ex(&used_key, 1, Duration::from_secs(remaining))
        .await?;

    if !claimed {
        return Err(AuthError::Expired);
    }

    let _ = session.remove(SESSION_CHALLENGE);

    Ok(())
}

pub fn used_key(context: &str) -> String {
    format!("{USED_KEY_PREFIX}{context}")
}