import { createHmac, timingSafeEqual } from 'crypto';
import { cookies } from 'next/headers';

export const CUSTOMER_SESSION_COOKIE = 'shahi_customer_session';
const SESSION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;

export interface CustomerSession {
  email: string;
  name?: string;
}

function getSessionSecret(): string {
  return process.env.CUSTOMER_SESSION_SECRET ?? 'shahi-kitchen-customer-dev-secret';
}

function encodeEmail(email: string): string {
  return Buffer.from(email, 'utf8').toString('base64url');
}

function decodeEmail(encoded: string): string | null {
  try {
    return Buffer.from(encoded, 'base64url').toString('utf8');
  } catch {
    return null;
  }
}

export function createCustomerSessionToken(session: CustomerSession): string {
  const issuedAt = Date.now().toString();
  const namePart = session.name ? `:${encodeEmail(session.name)}` : '';
  const payload = `customer:${encodeEmail(session.email)}${namePart}:${issuedAt}`;
  const signature = createHmac('sha256', getSessionSecret()).update(payload).digest('hex');
  return `${payload}.${signature}`;
}

export function verifyCustomerSessionToken(token: string | undefined | null): CustomerSession | null {
  if (!token) return null;

  const [payload, signature] = token.split('.');
  if (!payload || !signature) return null;

  const expected = createHmac('sha256', getSessionSecret()).update(payload).digest('hex');
  const sigBuffer = Buffer.from(signature);
  const expectedBuffer = Buffer.from(expected);
  if (sigBuffer.length !== expectedBuffer.length) return null;
  if (!timingSafeEqual(sigBuffer, expectedBuffer)) return null;

  const parts = payload.split(':');
  if (parts[0] !== 'customer' || parts.length < 3) return null;

  const issuedAt = Number(parts[parts.length - 1]);
  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > SESSION_MAX_AGE_MS) return null;

  const email = decodeEmail(parts[1]);
  if (!email) return null;

  let name: string | undefined;
  if (parts.length === 4) {
    name = decodeEmail(parts[2]) ?? undefined;
  }

  return { email, name };
}

export async function getCustomerSession(): Promise<CustomerSession | null> {
  const cookieStore = await cookies();
  const token = cookieStore.get(CUSTOMER_SESSION_COOKIE)?.value;
  return verifyCustomerSessionToken(token);
}

export function getCustomerSessionCookieOptions() {
  return {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax' as const,
    path: '/',
    maxAge: SESSION_MAX_AGE_MS / 1000,
  };
}

export function getClearedCustomerSessionCookieOptions() {
  return {
    ...getCustomerSessionCookieOptions(),
    maxAge: 0,
    expires: new Date(0),
  };
}