//! The owner's browser sign-in, shared by Radar and the API (spec §8.3): the owner's CLI signs a request for a

//! one-time link (`POST /radar/link`, valid 60 s); opening it starts a

//! browser session whose events carry that signed request as their proof

//! (level 2). The passkey (level 3) is 0.2. Sessions live in memory: a

//! restart signs the browser out.

use rand::RngCore;

use std::collections::HashMap;

use std::sync::Mutex;

/// How long a sign-in link is good for, and a session.

pub const LINK_MS: u64 = 60_000;

pub const SESSION_MS: u64 = 12 * 3_600_000;

/// What a session holds: the owner's key and the proof that opened it.

#[derive(Clone, Debug)]

pub struct Session {

    pub key: [u8; 32],

    pub proof: Vec<u8>,

    pub csrf: String,

    pub expires_ms: u64,

}

#[derive(Debug, Default)]

pub struct Sessions {

    codes: Mutex<HashMap<String, (Session, u64)>>,

    live: Mutex<HashMap<String, Session>>,

}

fn random_hex() -> String {

    let mut b = [0u8; 32];

    rand::rngs::OsRng.fill_bytes(&mut b);

    hex::encode(b)

}

impl Sessions {

    /// A one-time code for the owner, from their signed request.

    pub fn link(&self, key: [u8; 32], proof: Vec<u8>, now: u64) -> String {

        let code = random_hex();

        let s = Session { key, proof, csrf: random_hex(), expires_ms: now + SESSION_MS };

        let mut codes = self.codes.lock().unwrap();

        codes.retain(|_, (_, until)| *until > now);

        codes.insert(code.clone(), (s, now + LINK_MS));

        code

    }

    /// Spend a code: the session id, once, within a minute of the link.

    pub fn open(&self, code: &str, now: u64) -> Option<String> {

        let (s, until) = self.codes.lock().unwrap().remove(code)?;

        if until < now {

            return None;

        }

        let id = random_hex();

        let mut live = self.live.lock().unwrap();

        live.retain(|_, s| s.expires_ms > now);

        live.insert(id.clone(), s);

        Some(id)

    }

    pub fn get(&self, id: &str, now: u64) -> Option<Session> {

        self.live.lock().unwrap().get(id).filter(|s| s.expires_ms > now).cloned()

    }

    pub fn close(&self, id: &str) {

        self.live.lock().unwrap().remove(id);

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn a_link_opens_one_session_once_and_only_while_fresh() {

        let s = Sessions::default();

        let code = s.link([1; 32], vec![9], 1_000);

        let id = s.open(&code, 2_000).expect("fresh");

        assert!(s.open(&code, 2_000).is_none(), "spent");

        assert_eq!(s.get(&id, 3_000).unwrap().key, [1; 32]);

        assert!(s.get(&id, 1_000 + SESSION_MS + 1).is_none(), "expired");

        let stale = s.link([1; 32], vec![9], 1_000);

        assert!(s.open(&stale, 1_000 + LINK_MS + 1).is_none());

        s.close(&id);

        assert!(s.get(&id, 3_000).is_none());

    }

}