import { cookies } from 'next/headers'
import { scryptSync, randomBytes, timingSafeEqual } from 'crypto'
import { query } from './db'

export type Role = 'gestor' | 'vendedor'

export interface SessionUser {
  id: number
  nome: string
  email: string
  role: Role
}

// ── Password hashing ──────────────────────────────────────────────────────────
export function hashPassword(password: string): string {
  const salt = randomBytes(16).toString('hex')
  const hash = scryptSync(password, salt, 64).toString('hex')
  return `${salt}:${hash}`
}

export function verifyPassword(password: string, stored: string): boolean {
  try {
    const [salt, hash] = stored.split(':')
    const derived = scryptSync(password, salt, 64)
    return timingSafeEqual(derived, Buffer.from(hash, 'hex'))
  } catch {
    return false
  }
}

// ── Session helpers ───────────────────────────────────────────────────────────
export async function createSession(userId: number): Promise<string> {
  const token    = randomBytes(32).toString('hex')
  const expireAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) // 30 days
  await query(
    `INSERT INTO sessoes (token, usuario_id, expira_em) VALUES ($1, $2, $3)`,
    [token, userId, expireAt],
  )
  return token
}

export async function getSession(): Promise<SessionUser | null> {
  const jar   = await cookies()
  const token = jar.get('session')?.value
  if (!token) return null

  const rows = await query<SessionUser>(
    `SELECT u.id, u.nome, u.email, u.role
     FROM sessoes s
     JOIN usuarios u ON u.id = s.usuario_id
     WHERE s.token = $1 AND s.expira_em > NOW() AND u.ativo = true`,
    [token],
  )
  return rows[0] ?? null
}

export async function deleteSession(): Promise<void> {
  const jar   = await cookies()
  const token = jar.get('session')?.value
  if (token) {
    await query(`DELETE FROM sessoes WHERE token = $1`, [token])
  }
}