import { createHash } from 'crypto'
import Database from 'better-sqlite3'
import { join } from 'path'

// ── 数据库连接（用于 session 持久化）────────────────
let _sessionDB = null
function getSessionDB() {
  if (!_sessionDB) {
    const dbPath = join(process.cwd(), 'server', 'database', 'hulai.db')
    _sessionDB = new Database(dbPath)
    _sessionDB.pragma('journal_mode = WAL')
  }
  return _sessionDB
}

export function hashPassword(password) {
  return createHash('sha256').update(password).digest('hex')
}

export function createSession(userId) {
  const token = createHash('sha256')
    .update(`${userId}-${Date.now()}-${Math.random()}`)
    .digest('hex')

  const db = getSessionDB()
  db.prepare('INSERT OR REPLACE INTO sessions (token, user_id, created_at) VALUES (?, ?, ?)')
    .run(token, userId, new Date().toISOString())

  return token
}

export function validateSession(token) {
  const db = getSessionDB()
  const session = db.prepare('SELECT * FROM sessions WHERE token = ?').get(token)

  if (!session) return null

  // 7 天过期
  const createdAt = new Date(session.created_at).getTime()
  if (Date.now() - createdAt > 7 * 24 * 60 * 60 * 1000) {
    db.prepare('DELETE FROM sessions WHERE token = ?').run(token)
    return null
  }

  return { userId: session.user_id, createdAt }
}

export function destroySession(token) {
  const db = getSessionDB()
  db.prepare('DELETE FROM sessions WHERE token = ?').run(token)
}

// 清理过期 session（启动时执行一次）
try {
  const db = getSessionDB()
  db.prepare("DELETE FROM sessions WHERE datetime(created_at) < datetime('now', '-7 days')").run()
} catch {}

/**
 * 从请求中提取并验证管理员身份
 * 返回 session 对象或抛出 401 错误
 */
export function requireAdmin(event) {
  const authHeader = getRequestHeader(event, 'authorization')
  const token = authHeader?.replace('Bearer ', '')

  if (!token) {
    throw createError({ statusCode: 401, message: '请先登录' })
  }

  const session = validateSession(token)
  if (!session) {
    throw createError({ statusCode: 401, message: '登录已过期，请重新登录' })
  }

  return session
}