// 登录/注册: 验证码(服务端一次性校验) + 服务端签发会话 token
// 注意: 短信/邮件发送仍是假通道 (验证码固定 1111), 后续按 NFR-7 接真实短信
import { uu, dbCreateUser, dbGetUserByEmail, dbGetUserByPhone, dbGetUserById, dbGetSession, dbCreateSession, dbDeleteSession } from './db.js'

const VERIFICATION_CODE = '1111'
const CODE_EXPIRY_SECONDS = 300
const codes = new Map()

export function sendVerification(target) {
  codes.set(target, { code: VERIFICATION_CODE, expiresAt: Date.now() + CODE_EXPIRY_SECONDS * 1000 })
  console.log(`[auth] verification code for ${target}: ${VERIFICATION_CODE}`)
  return `验证码已发送至 ${target}`
}

function verifyCode(target, code) {
  const v = codes.get(target)
  if (!v) return false
  if (v.code !== code || Date.now() >= v.expiresAt) return false
  codes.delete(target)
  return true
}

export async function register({ email, phone, code, nickname }) {
  const target = email || phone
  if (!target) return { success: false, message: '请提供邮箱或手机号', user: null, token: null }
  if (!verifyCode(target, code)) {
    return { success: false, message: '验证码无效或已过期', user: null, token: null }
  }
  if (email && (await dbGetUserByEmail(email))) {
    return { success: false, message: '该邮箱已注册', user: null, token: null }
  }
  if (phone && (await dbGetUserByPhone(phone))) {
    return { success: false, message: '该手机号已注册', user: null, token: null }
  }
  const id = uu()
  const user = await dbCreateUser(id, email || null, phone || null, nickname || '收纳达人')
  const token = 'tok_' + uu().replaceAll('-', '')
  await dbCreateSession(token, id)
  console.log(`[auth] user registered: ${id}`)
  return { success: true, message: '注册成功', user, token }
}

export async function login({ email, phone, code }) {
  const target = email || phone
  if (!target) return { success: false, message: '请提供邮箱或手机号', user: null, token: null }
  if (!verifyCode(target, code)) {
    return { success: false, message: '验证码无效或已过期', user: null, token: null }
  }
  const user = email ? await dbGetUserByEmail(email) : await dbGetUserByPhone(phone)
  if (!user) return { success: false, message: '账号不存在，请先注册', user: null, token: null }
  const token = 'tok_' + uu().replaceAll('-', '')
  await dbCreateSession(token, user.id)
  console.log(`[auth] user login: ${user.id}`)
  return { success: true, message: '登录成功', user, token }
}

export async function logout(token) {
  if (token) await dbDeleteSession(token)
}

export async function resolveSession(token) {
  const s = token ? await dbGetSession(token) : null
  if (!s) return null
  const user = await dbGetUserById(s.user_id)
  return user
}