package auth

import (
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"strings"
	"sync"
	"time"

	"gitweb/internal/store"
)

// PATVerifier checks personal access tokens for the non-interactive (CI) auth
// path. A user stores the SHA-256 hashes of their tokens, one per line, in their
// own upspin tree at <user>/gitweb/tokens, and grants read on that file to the
// service. Ownership of the tree is the identity proof; possession of a token
// whose hash appears there authenticates as that user.
//
// File format, one entry per line:
//
//	# a comment
//	<64-hex sha256-of-token>  optional label words
type PATVerifier struct {
	st  store.Store
	ttl time.Duration

	mu    sync.Mutex
	cache map[string]patEntry // user -> parsed token hashes
}

type patEntry struct {
	hashes  [][32]byte
	expires time.Time
}

// NewPATVerifier returns a PATVerifier reading token files through st.
func NewPATVerifier(st store.Store) *PATVerifier {
	return &PATVerifier{st: st, ttl: 60 * time.Second, cache: map[string]patEntry{}}
}

// Verify reports whether token is a valid PAT for user. A missing or unreadable
// tokens file is not an error: it simply yields false (fail closed, no leak).
func (v *PATVerifier) Verify(user, token string) (bool, error) {
	if user == "" || token == "" {
		return false, nil
	}
	hashes, err := v.hashesFor(user)
	if err != nil {
		return false, err
	}
	want := sha256.Sum256([]byte(token))
	match := false
	// Compare against every entry without early exit, to keep the work
	// independent of which (if any) token matched.
	for i := range hashes {
		if subtle.ConstantTimeCompare(want[:], hashes[i][:]) == 1 {
			match = true
		}
	}
	return match, nil
}

func (v *PATVerifier) hashesFor(user string) ([][32]byte, error) {
	now := time.Now()
	v.mu.Lock()
	if e, ok := v.cache[user]; ok && now.Before(e.expires) {
		v.mu.Unlock()
		return e.hashes, nil
	}
	v.mu.Unlock()

	var hashes [][32]byte
	data, err := v.st.Get(user + "/gitweb/tokens")
	switch err {
	case nil:
		hashes = parseTokenFile(data)
	case store.ErrNotFound:
		// No tokens file: cache the empty result so repeated failed logins do
		// not hammer the store.
	default:
		return nil, err
	}

	v.mu.Lock()
	v.cache[user] = patEntry{hashes: hashes, expires: now.Add(v.ttl)}
	v.mu.Unlock()
	return hashes, nil
}

// parseTokenFile extracts the 32-byte token hashes from a tokens file, ignoring
// blank lines, comments, and malformed entries.
func parseTokenFile(data []byte) [][32]byte {
	var out [][32]byte
	for _, line := range strings.Split(string(data), "\n") {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		field := line
		if i := strings.IndexAny(line, " \t"); i >= 0 {
			field = line[:i]
		}
		raw, err := hex.DecodeString(field)
		if err != nil || len(raw) != 32 {
			continue
		}
		var h [32]byte
		copy(h[:], raw)
		out = append(out, h)
	}
	return out
}