using System.Security.Cryptography;
using System.Text;

namespace RadicadeServer.Auth;





public static class AdminSecurity
{


	private const int Pbkdf2Iterations = 600_000;
	private const int SaltSize = 16;
	private const int HashSize = 32;

	public static string HashPassword(string password)
	{
		var salt = RandomNumberGenerator.GetBytes(SaltSize);
		var hash = Rfc2898DeriveBytes.Pbkdf2(
			Encoding.UTF8.GetBytes(password), salt, Pbkdf2Iterations, HashAlgorithmName.SHA256, HashSize);
		return $"pbkdf2${Pbkdf2Iterations}${Convert.ToBase64String(salt)}${Convert.ToBase64String(hash)}";
	}

	public static bool VerifyPassword(string storedHash, string password)
	{
		if (string.IsNullOrWhiteSpace(storedHash)) return false;

		var parts = storedHash.Split('$');
		if (parts.Length != 4 || parts[0] != "pbkdf2") return false;
		if (!int.TryParse(parts[1], out var iterations)) return false;

		try
		{
			var salt = Convert.FromBase64String(parts[2]);
			var expected = Convert.FromBase64String(parts[3]);
			var actual = Rfc2898DeriveBytes.Pbkdf2(
				Encoding.UTF8.GetBytes(password), salt, iterations, HashAlgorithmName.SHA256, expected.Length);
			return CryptographicOperations.FixedTimeEquals(actual, expected);
		}
		catch
		{
			return false;
		}
	}

	public static bool NeedsRehash(string storedHash)
	{
		if (string.IsNullOrWhiteSpace(storedHash)) return false;

		var parts = storedHash.Split('$');
		if (parts.Length != 4 || parts[0] != "pbkdf2") return true;
		return !int.TryParse(parts[1], out var iterations) || iterations < Pbkdf2Iterations;
	}





	public static string? ValidatePasswordPolicy(string? password, string? username = null)
	{
		if (string.IsNullOrWhiteSpace(password) || password.Length < 12)
			return "Password must be at least 12 characters long.";
		if (!password.Any(char.IsUpper))
			return "Password must contain at least one uppercase letter.";
		if (!password.Any(char.IsLower))
			return "Password must contain at least one lowercase letter.";
		if (!password.Any(char.IsDigit))
			return "Password must contain at least one number.";
		if (!password.Any(ch => !char.IsLetterOrDigit(ch)))
			return "Password must contain at least one symbol (e.g. ! @ # $ %).";
		if (!string.IsNullOrWhiteSpace(username) && username.Length >= 3 &&
			password.Contains(username, StringComparison.OrdinalIgnoreCase))
			return "Password must not contain your username.";
		return null;
	}
}