import base64
import hashlib
import hmac
import secrets
from datetime import datetime, timedelta, timezone

from fastapi import Header, HTTPException
from sqlmodel import Session, select

from app.models import AdminCredential, AdminSession

SESSION_HOURS = 8


def _now() -> datetime:
    return datetime.now(timezone.utc).replace(tzinfo=None)


def _hash_token(token: str) -> str:
    return hashlib.sha256(token.encode("utf-8")).hexdigest()


def verify_pin(pin: str, encoded: str) -> bool:
    try:
        algorithm, iterations, salt_b64, digest_b64 = encoded.split("$", 3)
        if algorithm != "pbkdf2_sha256":
            return False
        salt = base64.b64decode(salt_b64.encode("ascii"))
        expected = base64.b64decode(digest_b64.encode("ascii"))
        actual = hashlib.pbkdf2_hmac("sha256", pin.encode("utf-8"), salt, int(iterations))
        return hmac.compare_digest(actual, expected)
    except Exception:
        return False


def login_admin(session: Session, pin: str) -> dict:
    credential = session.exec(select(AdminCredential).where(AdminCredential.username == "admin")).first()
    if credential is None or not verify_pin(pin, credential.pin_hash):
        raise HTTPException(status_code=401, detail={"code": "invalid_pin", "message": "PIN ist nicht korrekt"})

    token = secrets.token_urlsafe(32)
    expires_at = _now() + timedelta(hours=SESSION_HOURS)
    admin_session = AdminSession(token_hash=_hash_token(token), username="admin", expires_at=expires_at)
    session.add(admin_session)
    session.commit()
    session.refresh(admin_session)
    return {"token": token, "expires_at": expires_at.isoformat(), "username": "admin"}


def get_admin_session(session: Session, token: str | None) -> AdminSession:
    if not token:
        raise HTTPException(status_code=401, detail={"code": "admin_login_required", "message": "Admin Login erforderlich"})
    token_hash = _hash_token(token)
    admin_session = session.exec(select(AdminSession).where(AdminSession.token_hash == token_hash)).first()
    if admin_session is None or admin_session.revoked_at is not None or admin_session.expires_at <= _now():
        raise HTTPException(status_code=401, detail={"code": "admin_session_invalid", "message": "Admin Session abgelaufen"})
    return admin_session


def logout_admin(session: Session, token: str | None) -> dict:
    admin_session = get_admin_session(session, token)
    admin_session.revoked_at = _now()
    session.add(admin_session)
    session.commit()
    return {"ok": True}


def require_admin_session(
    x_admin_session: str | None = Header(default=None, alias="X-Admin-Session"),
):
    # Dependency factory marker; route modules wrap this with DB session because FastAPI
    # dependencies cannot share the same Session object here without circular imports.
    return x_admin_session