import { verify } from "@node-rs/argon2";
import type { JwtClaims, LoginRequest, LoginResponse } from "@cfdm/shared";
import type { AppConfig } from "../config.js";
import { AppError } from "../errors.js";

export async function verifyPassword(
  config: AppConfig,
  password: string,
): Promise<void> {
  if (config.adminPasswordHash === "devplaceholder") {
    if (password === "admin") return;
    throw AppError.unauthorized();
  }
  const ok = await verify(config.adminPasswordHash, password);
  if (!ok) throw AppError.unauthorized();
}

export async function login(
  config: AppConfig,
  sign: (payload: JwtClaims) => string,
  req: LoginRequest,
): Promise<LoginResponse> {
  if (req.username !== config.adminUsername) {
    throw AppError.unauthorized();
  }
  await verifyPassword(config, req.password);

  const expiresAt = new Date(
    Date.now() + config.jwtTtlHours * 60 * 60 * 1000,
  );
  const token = sign({
    sub: req.username,
    exp: Math.floor(expiresAt.getTime() / 1000),
  });

  return {
    token,
    expires_at: expiresAt.toISOString(),
  };
}