import { SignJWT, jwtVerify } from 'jose';
import bcrypt from 'bcryptjs';

// Astro dev (Vite) expose les .env via import.meta.env ; Node runtime prod via process.env.
// On lit les deux pour couvrir tous les cas (dev, preview, prod Plesk Node).
const env = {
  ...(typeof process !== 'undefined' ? process.env : {}),
  ...(import.meta.env as Record<string, string | undefined>),
};

const ADMIN_PASSWORD_HASH = (env.ADMIN_PASSWORD_HASH as string | undefined) ?? '';
const JWT_SECRET =
  (env.ADMIN_JWT_SECRET as string | undefined) ?? 'dev-secret-change-me-in-production';
const SECRET_KEY = new TextEncoder().encode(JWT_SECRET);

export const ADMIN_COOKIE = 'portfolio_admin';

export async function verifyPassword(password: string): Promise<boolean> {
  if (!ADMIN_PASSWORD_HASH) {
    console.error('[auth] ADMIN_PASSWORD_HASH manquant dans .env');
    return false;
  }
  return bcrypt.compare(password, ADMIN_PASSWORD_HASH);
}

export async function createSession(): Promise<string> {
  return new SignJWT({ role: 'admin' })
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime('7d')
    .sign(SECRET_KEY);
}

export async function verifySession(token: string | undefined): Promise<boolean> {
  if (!token) return false;
  try {
    await jwtVerify(token, SECRET_KEY);
    return true;
  } catch {
    return false;
  }
}

export function hashPasswordCLI(password: string): string {
  return bcrypt.hashSync(password, 12);
}
