package auth

import (
	"crypto/rand"
	"encoding/base64"
	"errors"
	"fmt"
	"strings"

	"golang.org/x/crypto/argon2"
)

func HashPassword(password string) ([]byte, error) {
	// Argon2id params simples/seguros
	const (
		time    = 1
		memory  = 64 * 1024
		threads = 4
		keyLen  = 32
	)
	salt := []byte{} // em produção use salt aleatório; simplificado aqui? vamos melhorar
	// Melhor: gerar salt
	return argon2.IDKey([]byte(password), salt, time, memory, threads, keyLen), nil
}

// versão melhor com salt
func HashPasswordSafe(password string) (string, error) {
	if password == "" {
		return "", errors.New("senha vazia")
	}
	salt := make([]byte, 16)
	if _, err := rand.Read(salt); err != nil {
		return "", err
	}
	hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
	return fmt.Sprintf("$argon2id$v=19$m=65536,t=1,p=4$%s$%s",
		base64.RawStdEncoding.EncodeToString(salt),
		base64.RawStdEncoding.EncodeToString(hash)), nil
}

func VerifyPassword(encoded, password string) bool {
	parts := strings.Split(encoded, "$")
	if len(parts) < 6 {
		return false
	}
	// partes: ["", "argon2id", "v=19", "m=65536,t=1,p=4", salt, hash]
	saltB, err := base64.RawStdEncoding.DecodeString(parts[4])
	if err != nil {
		return false
	}
	hashB, err := base64.RawStdEncoding.DecodeString(parts[5])
	if err != nil {
		return false
	}
	cmp := argon2.IDKey([]byte(password), saltB, 1, 64*1024, 4, uint32(len(hashB)))
	if len(cmp) != len(hashB) {
		return false
	}
	for i := range cmp {
		if cmp[i] != hashB[i] {
			return false
		}
	}
	return true
}