import { createHmac, timingSafeEqual } from "crypto";
import { cookies } from "next/headers";

const COOKIE_NAME = "backlog_admin_session";
const SESSION_TTL_SECONDS = 60 * 60 * 8; // 8 hours

function sign(value: string): string {
  return createHmac("sha256", process.env.SESSION_SECRET!).update(value).digest("hex");
}

export function createSessionCookie(adminId: string) {
  const expires = Date.now() + SESSION_TTL_SECONDS * 1000;
  const payload = `${adminId}.${expires}`;
  const signature = sign(payload);
  return `${payload}.${signature}`;
}

export function verifySessionCookie(cookieValue: string | undefined): string | null {
  if (!cookieValue) return null;
  const [adminId, expiresStr, signature] = cookieValue.split(".");
  if (!adminId || !expiresStr || !signature) return null;

  const expected = sign(`${adminId}.${expiresStr}`);
  const sigBuf = Buffer.from(signature);
  const expBuf = Buffer.from(expected);
  if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) return null;

  if (Date.now() > Number(expiresStr)) return null;
  return adminId;
}

export function getAdminIdFromRequest(): string | null {
  return verifySessionCookie(cookies().get(COOKIE_NAME)?.value);
}

export { COOKIE_NAME, SESSION_TTL_SECONDS };