import crypto from 'crypto';

const ADMIN_SECRET = process.env.ADMIN_SECRET || 'changeme';
const SUPER_ADMIN_SECRET = process.env.SUPER_ADMIN_SECRET || '';

export type AdminRole = 'admin' | 'super_admin';

export interface AdminPayload {
  role: AdminRole;
  jti: string;
  iat: number;
  exp: number;
}

export function createToken(secret: string): string {
  const isSuper = SUPER_ADMIN_SECRET && secret === SUPER_ADMIN_SECRET;
  const isAdmin = secret === ADMIN_SECRET;
  
  if (!isAdmin && !isSuper) return '';

  // If no super secret set, all admins are super
  const role: AdminRole = (!SUPER_ADMIN_SECRET || isSuper) ? 'super_admin' : 'admin';

  const payload: AdminPayload = {
    role,
    jti: crypto.randomUUID(),
    iat: Math.floor(Date.now() / 1000),
    exp: Math.floor(Date.now() / 1000) + 86400,
  };

  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
  const signingKey = SUPER_ADMIN_SECRET || ADMIN_SECRET;
  const sig = crypto
    .createHmac('sha256', signingKey)
    .update(payloadB64)
    .digest('base64url');

  return `${payloadB64}.${sig}`;
}

export function verifyToken(token: string): AdminPayload | null {
  try {
    const [payloadB64, sig] = token.split('.');
    if (!payloadB64 || !sig) return null;

    const signingKey = SUPER_ADMIN_SECRET || ADMIN_SECRET;
    const expected = crypto
      .createHmac('sha256', signingKey)
      .update(payloadB64)
      .digest('base64url');

    if (sig !== expected) return null;

    const payload: AdminPayload = JSON.parse(
      Buffer.from(payloadB64, 'base64url').toString()
    );

    if (payload.exp < Math.floor(Date.now() / 1000)) return null;
    return payload;
  } catch {
    return null;
  }
}

export function verifyReAuth(token: string): boolean {
  const isSuper = SUPER_ADMIN_SECRET && token === SUPER_ADMIN_SECRET;
  const isAdmin = token === ADMIN_SECRET;
  return isSuper || isAdmin;
}