use argon2::Argon2;
use argon2::password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString};

pub const COOKIE_NAME: &str = "fbng_session";
/// 30 days.
pub const SESSION_MAX_AGE: u64 = 60 * 60 * 24 * 30;

pub fn hash_password(password: &str) -> anyhow::Result<String> {
    let salt = SaltString::generate(&mut rand::thread_rng());
    let hash = Argon2::default()
        .hash_password(password.as_bytes(), &salt)
        .map_err(|e| anyhow::anyhow!("password hashing failed: {e}"))?;
    Ok(hash.to_string())
}

pub fn verify_password(password: &str, hash: &str) -> bool {
    let Ok(parsed) = PasswordHash::new(hash) else {
        return false;
    };
    Argon2::default()
        .verify_password(password.as_bytes(), &parsed)
        .is_ok()
}

/// 32 random bytes, hex-encoded (64 chars).
pub fn random_token() -> String {
    hex_token(32)
}

/// 16 random bytes, hex-encoded (32 chars). Used for public share links.
pub fn share_token() -> String {
    hex_token(16)
}

fn hex_token(bytes: usize) -> String {
    use rand::RngCore;
    use std::fmt::Write as _;
    let mut b = vec![0u8; bytes];
    rand::thread_rng().fill_bytes(&mut b);
    b.iter().fold(String::with_capacity(bytes * 2), |mut s, x| {
        let _ = write!(s, "{x:02x}");
        s
    })
}

pub fn session_cookie(token: &str, https: bool) -> String {
    let mut c =
        format!("{COOKIE_NAME}={token}; Path=/; HttpOnly; SameSite=Lax; Max-Age={SESSION_MAX_AGE}");
    if https {
        c.push_str("; Secure");
    }
    c
}

pub fn clear_session_cookie(https: bool) -> String {
    let mut c = format!("{COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
    if https {
        c.push_str("; Secure");
    }
    c
}

/// Extract the session token from the Cookie header, if present.
pub fn parse_session_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
    let header = headers.get(axum::http::header::COOKIE)?.to_str().ok()?;
    for part in header.split(';') {
        let part = part.trim();
        if let Some((k, v)) = part.split_once('=')
            && k == COOKIE_NAME
            && !v.is_empty()
        {
            return Some(v.to_string());
        }
    }
    None
}

#[cfg(test)]
mod tests {
    use super::*;
    use axum::http::{HeaderMap, header};

    #[test]
    fn password_hash_round_trip() {
        let h = hash_password("hunter22").unwrap();
        assert!(verify_password("hunter22", &h));
        assert!(!verify_password("wrong-password", &h));
        assert!(!verify_password("hunter23", &h));
        // Fresh salt on every hash.
        assert_ne!(h, hash_password("hunter22").unwrap());
        // Argon2id marker is present.
        assert!(h.starts_with("$argon2id$"));
    }

    #[test]
    fn verify_rejects_garbage_hashes() {
        assert!(!verify_password("x", ""));
        assert!(!verify_password("x", "not-a-hash"));
        assert!(!verify_password("x", "$argon2id$"));
    }

    #[test]
    fn token_shapes_and_uniqueness() {
        let t = random_token();
        assert_eq!(t.len(), 64);
        assert!(t.chars().all(|c| c.is_ascii_hexdigit()));

        let s = share_token();
        assert_eq!(s.len(), 32);
        assert!(s.chars().all(|c| c.is_ascii_hexdigit()));

        let mut seen = std::collections::HashSet::new();
        for _ in 0..100 {
            assert!(seen.insert(random_token()), "session token collision");
            assert!(seen.insert(share_token()), "share token collision");
        }
    }

    #[test]
    fn session_cookie_shape() {
        let c = session_cookie("tok123", false);
        assert!(c.starts_with("fbng_session=tok123;"));
        assert!(c.contains("Path=/"));
        assert!(c.contains("HttpOnly"));
        assert!(c.contains("SameSite=Lax"));
        assert!(c.contains(&format!("Max-Age={SESSION_MAX_AGE}")));
        assert!(!c.contains("Secure"));

        let c = session_cookie("tok123", true);
        assert!(c.ends_with("; Secure"));

        let c = clear_session_cookie(true);
        assert!(c.starts_with("fbng_session=;"));
        assert!(c.contains("Max-Age=0"));
        assert!(c.contains("Secure"));
        assert!(!clear_session_cookie(false).contains("Secure"));
    }

    #[test]
    fn parse_session_cookie_variants() {
        let mut h = HeaderMap::new();
        h.insert(
            header::COOKIE,
            "other=1; fbng_session=abc123; x=y".parse().unwrap(),
        );
        assert_eq!(parse_session_cookie(&h).as_deref(), Some("abc123"));

        let mut h = HeaderMap::new();
        h.insert(header::COOKIE, "other=1".parse().unwrap());
        assert_eq!(parse_session_cookie(&h), None);

        // Empty value → treated as absent.
        let mut h = HeaderMap::new();
        h.insert(header::COOKIE, "fbng_session=".parse().unwrap());
        assert_eq!(parse_session_cookie(&h), None);

        assert_eq!(parse_session_cookie(&HeaderMap::new()), None);

        // First occurrence wins.
        let mut h = HeaderMap::new();
        h.insert(
            header::COOKIE,
            "fbng_session=first; fbng_session=second".parse().unwrap(),
        );
        assert_eq!(parse_session_cookie(&h).as_deref(), Some("first"));

        // Cookie name must match exactly.
        let mut h = HeaderMap::new();
        h.insert(
            header::COOKIE,
            "fbng_session2=x; Xfbng_session=y".parse().unwrap(),
        );
        assert_eq!(parse_session_cookie(&h), None);
    }
}