import { notifications } from "@mantine/notifications";
import { ARGON2_PARAMETERS } from "@shared/argon2Parameters";
import { argon2id } from "hash-wasm";
import { addLogEntry } from "./logEntries";

const ACCESS_KEY_STORAGE_KEY = "accessKeyHash";

interface StoredAccessKey {
  hash: string;
  timestamp: number;
}

async function hashAccessKey(accessKey: string): Promise<string> {
  const salt = new Uint8Array(16);
  crypto.getRandomValues(salt);

  return argon2id({
    password: accessKey,
    salt,
    ...ARGON2_PARAMETERS,
    outputType: "encoded",
  });
}

/**
 * Validates the key against the server; on success the hash is stored locally
 * so later loads can go through `verifyStoredAccessKey`.
 */
export type AccessKeyResult = "valid" | "invalid" | "rateLimited";

export async function validateAccessKey(
  accessKey: string,
): Promise<AccessKeyResult> {
  try {
    const hash = await hashAccessKey(accessKey);
    const response = await fetch("/api/validate-access-key", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ accessKeyHash: hash }),
    });

    // A 429 is "try again in a moment", not "wrong key": keep the two apart so
    // the caller can show a refusal message instead of a wrong-key error.
    if (response.status === 429) {
      addLogEntry("Access key validation rate-limited");
      notifications.show({
        title: "Too many attempts",
        message: "Please wait a few seconds and try again",
        color: "yellow",
        position: "top-right",
      });
      return "rateLimited";
    }

    const data = await response.json();

    if (data.valid) {
      const storedData: StoredAccessKey = {
        hash,
        timestamp: Date.now(),
      };
      localStorage.setItem(ACCESS_KEY_STORAGE_KEY, JSON.stringify(storedData));
      addLogEntry("Access key hash stored");
      return "valid";
    }

    return "invalid";
  } catch (error) {
    addLogEntry(`Error validating access key: ${error}`);
    notifications.show({
      title: "Error validating access key",
      message: "Please contact the administrator",
      color: "red",
      position: "top-right",
    });
    return "invalid";
  }
}

/**
 * Re-validates the stored hash, still usable for `timeoutHours` since it was
 * first validated; 0 means every load asks for the key again.
 */
export async function verifyStoredAccessKey(
  timeoutHours: number,
): Promise<boolean> {
  if (timeoutHours === 0) return false;

  const storedData = localStorage.getItem(ACCESS_KEY_STORAGE_KEY);
  if (!storedData) return false;

  try {
    const { hash, timestamp }: StoredAccessKey = JSON.parse(storedData);

    const expirationTime = timeoutHours * 60 * 60 * 1000;
    if (Date.now() - timestamp > expirationTime) {
      localStorage.removeItem(ACCESS_KEY_STORAGE_KEY);
      addLogEntry("Stored access key expired");
      return false;
    }

    const response = await fetch("/api/validate-access-key", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ accessKeyHash: hash }),
    });

    // A 429 must not be read as "wrong key": the stored hash may be fine and
    // the caller simply hit the rate limiter. Keep the hash on disk so a
    // later load can still validate it.
    if (response.status === 429) {
      addLogEntry("Stored access key validation rate-limited");
      return false;
    }

    const data = await response.json();
    if (!data.valid) {
      localStorage.removeItem(ACCESS_KEY_STORAGE_KEY);
      addLogEntry("Stored access key is no longer valid");
      return false;
    }

    addLogEntry("Using stored access key");
    return true;
  } catch (error) {
    addLogEntry(`Error verifying stored access key: ${error}`);
    localStorage.removeItem(ACCESS_KEY_STORAGE_KEY);
    return false;
  }
}