const crypto = require("crypto");
const db = require("../../models");

const digest = (token) => crypto.createHash("sha256").update(token).digest("hex");
const safeEqual = (left, right) => left?.length === right?.length && crypto.timingSafeEqual(Buffer.from(left), Buffer.from(right));
const rawToken = (id) => `${id}.${crypto.randomBytes(48).toString("base64url")}`;
const tokenId = (token) => typeof token === "string" ? token.split(".", 1)[0] : null;
const ttlDays = (rememberMe) => Number(process.env[rememberMe ? "REMEMBER_ME_REFRESH_TOKEN_TTL_DAYS" : "REFRESH_TOKEN_TTL_DAYS"] || (rememberMe ? 30 : 7));

const createSession = async ({ user, rememberMe = false, deviceName, userAgent, ipAddress, familyId, transaction }) => {
  const id = crypto.randomUUID();
  const refreshToken = rawToken(id);
  const expiresAt = new Date(Date.now() + ttlDays(rememberMe) * 86400000);
  const session = await db.AuthSession.create({
    id, user_id: user.id, token_family_id: familyId || crypto.randomUUID(), refresh_token_hash: digest(refreshToken),
    device_name: deviceName, user_agent: userAgent, ip_address: ipAddress, remember_me: rememberMe,
    token_version: user.tokenVersion, last_used_at: new Date(), expires_at: expiresAt,
  }, { transaction });
  return { session, refreshToken, expiresAt };
};

const revokeFamily = async (familyId, reason, transaction) => db.AuthSession.update(
  { revoked_at: new Date(), revoked_reason: reason },
  { where: { token_family_id: familyId, revoked_at: null }, transaction },
);

const rotateSession = async (token, context = {}) => db.sequelize.transaction(async (transaction) => {
  const id = tokenId(token);
  if (!id) throw Object.assign(new Error("Invalid session"), { code: "INVALID_SESSION", status: 401 });
  const session = await db.AuthSession.findByPk(id, { transaction, lock: transaction.LOCK.UPDATE });
  if (!session) throw Object.assign(new Error("Invalid session"), { code: "INVALID_SESSION", status: 401 });
  if (!safeEqual(digest(token), session.refresh_token_hash)) throw Object.assign(new Error("Invalid session"), { code: "INVALID_SESSION", status: 401 });
  if (session.revoked_at) {
    if (session.revoked_reason === "ROTATED") await revokeFamily(session.token_family_id, "REFRESH_TOKEN_REUSE", transaction);
    throw Object.assign(new Error("Invalid session"), { code: session.revoked_reason === "ROTATED" ? "REFRESH_TOKEN_REUSE" : "INVALID_SESSION", status: 401 });
  }
  if (session.expires_at <= new Date()) {
    session.revoked_at = new Date(); session.revoked_reason = "EXPIRED"; await session.save({ transaction });
    throw Object.assign(new Error("Invalid session"), { code: "INVALID_SESSION", status: 401 });
  }
  const user = await db.User.findByPk(session.user_id, { transaction, lock: transaction.LOCK.UPDATE });
  if (!user || user.accountStatus !== "ACTIVE" || user.tokenVersion !== session.token_version) {
    await revokeFamily(session.token_family_id, "ACCOUNT_OR_TOKEN_VERSION_INVALID", transaction);
    throw Object.assign(new Error("Invalid session"), { code: "INVALID_SESSION", status: 401 });
  }
  const replacement = await createSession({ user, rememberMe: session.remember_me, familyId: session.token_family_id, ...context, transaction });
  session.revoked_at = new Date(); session.revoked_reason = "ROTATED"; session.replaced_by_session_id = replacement.session.id;
  session.last_used_at = new Date(); await session.save({ transaction });
  return { ...replacement, user };
});

const revokeSession = async (id, reason = "LOGOUT", transaction) => db.AuthSession.update(
  { revoked_at: new Date(), revoked_reason: reason }, { where: { id, revoked_at: null }, transaction },
);
const revokeAllUserSessions = async (userId, reason, transaction) => db.AuthSession.update(
  { revoked_at: new Date(), revoked_reason: reason }, { where: { user_id: userId, revoked_at: null }, transaction },
);

module.exports = { createSession, rotateSession, revokeSession, revokeFamily, revokeAllUserSessions, hashRefreshToken: digest, tokenId };