import { COOKIE_NAME, ONE_YEAR_MS } from "@shared/const";
import { ForbiddenError } from "@shared/_core/errors";
import { SignJWT, jwtVerify } from "jose";
import * as crypto from "node:crypto";
import { promisify } from "node:util";
import { parse as parseCookieHeader } from "cookie";
import type { Request, Response } from "express";
import type { User } from "../../drizzle/schema";
import * as db from "../db";
import { ENV } from "./env";
import { getSessionCookieOptions } from "./cookies";
import { canSendOperationalEmails, sendOperationalEmail } from "../mailer";

const scryptAsync = promisify(crypto.scrypt);
const argon2Async =
  typeof (crypto as any).argon2 === "function"
    ? promisify((crypto as any).argon2)
    : null;
const KEY_LENGTH = 64;
const LOGIN_FAILURE_LIMIT = 5;
const LOGIN_LOCK_DURATION_MS = 15 * 60 * 1000;
const MFA_CODE_TTL_MS = 10 * 60 * 1000;
const MFA_CODE_ATTEMPT_LIMIT = 5;
const RETENTION_REPORT_SETTING_KEY = "retention.lastReport";
const SYSTEM_ACTOR_USER_ID = 0;

const INTERNAL_MFA_POLICY = {
  super_admin: {
    required: true,
    preferredMethod: "authenticator_app",
    enforcedMethod: "authenticator_app",
    emailFallbackAllowed: false,
    phaseLabel: "Phase 2 cible",
  },
  admin: {
    required: true,
    preferredMethod: "authenticator_app",
    enforcedMethod: "authenticator_app",
    emailFallbackAllowed: false,
    phaseLabel: "Phase 2 active",
  },
  directrice: {
    required: true,
    preferredMethod: "authenticator_app",
    enforcedMethod: "authenticator_app",
    emailFallbackAllowed: false,
    phaseLabel: "Phase 2 active",
  },
  accueil: {
    required: true,
    preferredMethod: "authenticator_app",
    enforcedMethod: null,
    emailFallbackAllowed: true,
    phaseLabel: "Phase 1 active",
  },
  service_terrain: {
    required: true,
    preferredMethod: "authenticator_app",
    enforcedMethod: null,
    emailFallbackAllowed: true,
    phaseLabel: "Phase 1 active",
  },
  logistique_controle: {
    required: true,
    preferredMethod: "authenticator_app",
    enforcedMethod: null,
    emailFallbackAllowed: true,
    phaseLabel: "Phase 1 active",
  },
} as const;

class AccountLockedError extends Error {
  constructor(public lockedUntil: Date) {
    super(`Compte temporairement verrouillé jusqu'au ${lockedUntil.toLocaleTimeString("fr-FR", {
      hour: "2-digit",
      minute: "2-digit",
    })}.`);
  }
}

class MfaChallengeRequiredError extends Error {
  constructor(
    public challengeType: "email" | "totp",
    public challengeToken: string,
    public expiresAt: Date,
    public maskedEmail?: string,
  ) {
    super("Code de verification requis");
  }
}

type JwtPayload = {
  userId: number;
  openId: string;
};

type BootstrapUserConfig = {
  email: string;
  password: string;
  name?: string;
  role?: User["role"];
};

function createBootstrapUser(config: BootstrapUserConfig, index: number): User {
  const email = normalizeEmail(config.email);
  const now = new Date();

  return {
    id: index + 1,
    openId: email,
    name: config.name ?? email.split("@")[0] ?? "Utilisateur",
    email,
    passwordHash: null,
    loginMethod: "bootstrap_jwt",
    role: config.role ?? "admin",
    canManageLogistics: config.role === "super_admin",
    delegatedSalleSignerUserId: null,
    privacyConsentVersion: null,
    privacyConsentAcceptedAt: null,
    privacyConsentContext: null,
    failedLoginAttempts: 0,
    lockedUntil: null,
    mfaEnabled: false,
    mfaMethod: null,
    mfaChallengeToken: null,
    mfaCodeHash: null,
    mfaCodeExpiresAt: null,
    mfaCodeAttempts: 0,
    mfaTotpSecretEncrypted: null,
    mfaTotpPendingSecretEncrypted: null,
    deletionRequestedAt: null,
    purgeScheduledAt: null,
    purgedAt: null,
    legalHold: false,
    legalHoldReason: null,
    isActive: true,
    createdAt: now,
    updatedAt: now,
    lastSignedIn: now,
  };
}

function getBootstrapUserConfigs(): BootstrapUserConfig[] {
  const users: BootstrapUserConfig[] = [];

  if (ENV.bootstrapUsers) {
    try {
      const parsed = JSON.parse(ENV.bootstrapUsers) as BootstrapUserConfig[];
      if (Array.isArray(parsed)) {
        users.push(...parsed);
      }
    } catch (error) {
      console.error("[Auth] BOOTSTRAP_USERS is not valid JSON", error);
    }
  }

  if (ENV.bootstrapAdminEmail && ENV.bootstrapAdminPassword) {
    users.push({
      email: ENV.bootstrapAdminEmail,
      password: ENV.bootstrapAdminPassword,
      name: ENV.bootstrapAdminName,
      role: "super_admin",
    });
  }

  return users;
}

function getBootstrapUsers(): User[] {
  return getBootstrapUserConfigs().map((config, index) =>
    createBootstrapUser(config, index)
  );
}

function findBootstrapUserByCredentials(input: { email: string; password: string }) {
  const email = normalizeEmail(input.email);
  const configs = getBootstrapUserConfigs();
  const index = configs.findIndex(
    config => normalizeEmail(config.email) === email && config.password === input.password
  );

  if (index === -1) return null;
  return createBootstrapUser(configs[index], index);
}

function findBootstrapUserByOpenId(openId: string) {
  return getBootstrapUsers().find(user => user.openId === openId) ?? null;
}

function getJwtSecret() {
  const secret = ENV.cookieSecret;
  if (!secret && ENV.isProduction) {
    throw new Error("JWT_SECRET is required in production");
  }
  return new TextEncoder().encode(secret || "local-dev-secret-change-me");
}

function normalizeEmail(email: string) {
  return email.trim().toLowerCase();
}

async function ensureConfiguredOwnerPrivileges(user: User): Promise<User> {
  if (!user.email || !ENV.adminEmail) return user;

  const isConfiguredOwner = normalizeEmail(user.email) === normalizeEmail(ENV.adminEmail);
  if (!isConfiguredOwner) return user;

  if (user.role === "super_admin" && user.canManageLogistics) {
    return user;
  }

  await db.updateUser(user.id, {
    role: "super_admin",
    canManageLogistics: true,
  });

  return {
    ...user,
    role: "super_admin",
    canManageLogistics: true,
  };
}

function parseCookies(cookieHeader: string | undefined) {
  if (!cookieHeader) return new Map<string, string>();
  return new Map(Object.entries(parseCookieHeader(cookieHeader)));
}

function hashOtpCode(code: string) {
  return crypto.createHash("sha256").update(code).digest("hex");
}

function buildSecurityCipherKey() {
  return crypto.createHash("sha256")
    .update(ENV.cookieSecret || "local-dev-auth-security")
    .digest();
}

function encryptSecuritySecret(value: string) {
  const iv = crypto.randomBytes(12);
  const key = buildSecurityCipherKey();
  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
  const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
  const tag = cipher.getAuthTag();
  return `${iv.toString("base64")}.${tag.toString("base64")}.${encrypted.toString("base64")}`;
}

function decryptSecuritySecret(value?: string | null) {
  if (!value) return "";
  const [ivBase64, tagBase64, encryptedBase64] = value.split(".");
  if (!ivBase64 || !tagBase64 || !encryptedBase64) return "";
  try {
    const key = buildSecurityCipherKey();
    const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(ivBase64, "base64"));
    decipher.setAuthTag(Buffer.from(tagBase64, "base64"));
    const decrypted = Buffer.concat([
      decipher.update(Buffer.from(encryptedBase64, "base64")),
      decipher.final(),
    ]);
    return decrypted.toString("utf8");
  } catch {
    return "";
  }
}

const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";

function encodeBase32(buffer: Buffer) {
  let bits = 0;
  let value = 0;
  let output = "";
  for (let index = 0; index < buffer.length; index += 1) {
    const byte = buffer[index]!;
    value = (value << 8) | byte;
    bits += 8;
    while (bits >= 5) {
      output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
      bits -= 5;
    }
  }
  if (bits > 0) {
    output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
  }
  return output;
}

function decodeBase32(input: string) {
  const normalized = input.toUpperCase().replace(/=+$/g, "").replace(/[^A-Z2-7]/g, "");
  let bits = 0;
  let value = 0;
  const output: number[] = [];

  for (const char of normalized) {
    const index = BASE32_ALPHABET.indexOf(char);
    if (index === -1) continue;
    value = (value << 5) | index;
    bits += 5;
    if (bits >= 8) {
      output.push((value >>> (bits - 8)) & 255);
      bits -= 8;
    }
  }

  return Buffer.from(output);
}

function generateTotpSecret() {
  return encodeBase32(crypto.randomBytes(20));
}

function buildOtpAuthUrl(email: string, secret: string) {
  const label = encodeURIComponent(`Portail Associations:${email}`);
  const issuer = encodeURIComponent("Portail Associations");
  return `otpauth://totp/${label}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=6&period=30`;
}

function generateTotpCode(secret: string, timestamp: number) {
  const key = decodeBase32(secret);
  const counter = Math.floor(timestamp / 30_000);
  const counterBuffer = Buffer.alloc(8);
  counterBuffer.writeBigUInt64BE(BigInt(counter));
  const hmac = crypto.createHmac("sha1", key).update(counterBuffer).digest();
  const offset = hmac[hmac.length - 1] & 0x0f;
  const binary = ((hmac[offset] & 0x7f) << 24)
    | ((hmac[offset + 1] & 0xff) << 16)
    | ((hmac[offset + 2] & 0xff) << 8)
    | (hmac[offset + 3] & 0xff);
  return String(binary % 1_000_000).padStart(6, "0");
}

function verifyTotpCode(secret: string, code: string) {
  const trimmedCode = code.trim();
  const now = Date.now();
  for (const drift of [-30_000, 0, 30_000]) {
    if (generateTotpCode(secret, now + drift) === trimmedCode) {
      return true;
    }
  }
  return false;
}

function maskEmail(email: string) {
  const [localPart, domain = ""] = email.split("@");
  if (!localPart) return email;
  const visibleStart = localPart.slice(0, 2);
  const visibleEnd = localPart.length > 4 ? localPart.slice(-1) : "";
  const maskedCore = "*".repeat(Math.max(localPart.length - visibleStart.length - visibleEnd.length, 1));
  return `${visibleStart}${maskedCore}${visibleEnd}@${domain}`;
}

function generateOtpCode() {
  return String(Math.floor(100000 + Math.random() * 900000));
}

function getPasswordHashAlgorithm(passwordHash: string | null | undefined) {
  if (!passwordHash) return null;
  const [algorithm] = passwordHash.split(":");
  return algorithm || null;
}

export function getInternalMfaPolicy(role: User["role"]) {
  return INTERNAL_MFA_POLICY[role as keyof typeof INTERNAL_MFA_POLICY] ?? null;
}

export function isInternalRole(role: User["role"]) {
  return Boolean(getInternalMfaPolicy(role));
}

function requiresMfaByRole(user: User) {
  return Boolean(getInternalMfaPolicy(user.role)?.required);
}

function requiresTotpByRole(user: User) {
  return getInternalMfaPolicy(user.role)?.enforcedMethod === "authenticator_app";
}

function allowsEmailMfaByRole(user: User) {
  return getInternalMfaPolicy(user.role)?.emailFallbackAllowed !== false;
}

function getEffectiveMfaMethod(user: User): "email" | "totp" | null {
  const hasTotp = Boolean(user.mfaMethod === "authenticator_app" && user.mfaTotpSecretEncrypted);
  if (hasTotp) return "totp";
  if ((user.mfaEnabled || requiresMfaByRole(user)) && user.email && allowsEmailMfaByRole(user)) return "email";
  return null;
}

async function hashPassword(password: string) {
  if (!argon2Async) {
    const salt = crypto.randomBytes(16).toString("hex");
    const derivedKey = (await scryptAsync(password, salt, KEY_LENGTH)) as Buffer;
    return `scrypt:${salt}:${derivedKey.toString("hex")}`;
  }

  const nonce = crypto.randomBytes(16);
  const derivedKey = (await argon2Async("argon2id", {
    message: Buffer.from(password),
    nonce,
    parallelism: 1,
    tagLength: 32,
    memory: 65536,
    passes: 3,
  })) as Buffer;
  return `argon2id:${nonce.toString("base64url")}:${derivedKey.toString("base64url")}`;
}

export async function hashLocalPassword(password: string) {
  return hashPassword(password);
}

async function verifyPassword(password: string, passwordHash: string | null | undefined) {
  if (!passwordHash) return false;

  const [algorithm, salt, key] = passwordHash.split(":");
  if (algorithm === "argon2id" && salt && key && argon2Async) {
    const nonce = Buffer.from(salt, "base64url");
    const expected = Buffer.from(key, "base64url");
    const derivedKey = (await argon2Async("argon2id", {
      message: Buffer.from(password),
      nonce,
      parallelism: 1,
      tagLength: expected.length,
      memory: 65536,
      passes: 3,
    })) as Buffer;
    return derivedKey.length === expected.length && crypto.timingSafeEqual(derivedKey, expected);
  }

  if (algorithm !== "scrypt" || !salt || !key) return false;

  const storedKey = Buffer.from(key, "hex");
  const derivedKey = (await scryptAsync(password, salt, storedKey.length)) as Buffer;

  if (storedKey.length !== derivedKey.length) return false;
  return crypto.timingSafeEqual(storedKey, derivedKey);
}

async function resetLoginSecurityState(userId: number) {
  await db.updateUser(userId, {
    failedLoginAttempts: 0,
    lockedUntil: null,
  });
}

async function registerLoginFailure(user: User) {
  const nextAttempts = (user.failedLoginAttempts || 0) + 1;
  const lockNow = nextAttempts >= LOGIN_FAILURE_LIMIT;
  await db.updateUser(user.id, {
    failedLoginAttempts: lockNow ? 0 : nextAttempts,
    lockedUntil: lockNow ? new Date(Date.now() + LOGIN_LOCK_DURATION_MS) : null,
  });
}

function assertUserNotLocked(user: User) {
  if (user.lockedUntil && new Date(user.lockedUntil) > new Date()) {
    throw new AccountLockedError(new Date(user.lockedUntil));
  }
}

async function sendLoginMfaChallenge(user: User) {
  if (requiresTotpByRole(user) && !user.mfaTotpSecretEncrypted) {
    throw new Error("Ce rôle interne doit utiliser l'application Authenticator. Faites initialiser le compte avant la prochaine connexion.");
  }

  const effectiveMethod = getEffectiveMfaMethod(user);

  if (effectiveMethod === "totp") {
    const challengeToken = crypto.randomBytes(24).toString("base64url");
    const expiresAt = new Date(Date.now() + MFA_CODE_TTL_MS);
    await db.updateUser(user.id, {
      mfaChallengeToken: challengeToken,
      mfaCodeHash: null,
      mfaCodeExpiresAt: expiresAt,
      mfaCodeAttempts: 0,
    });
    return new MfaChallengeRequiredError("totp", challengeToken, expiresAt);
  }

  if (!user.email) {
    throw new Error("Ce compte ne dispose pas d'une adresse email exploitable pour le MFA.");
  }

  const mailReady = await canSendOperationalEmails();
  if (!mailReady) {
    throw new Error("Le MFA par email ne peut pas etre active tant que le SMTP n'est pas configure.");
  }

  const code = generateOtpCode();
  const expiresAt = new Date(Date.now() + MFA_CODE_TTL_MS);
  const challengeToken = crypto.randomBytes(24).toString("base64url");

  await db.updateUser(user.id, {
    mfaChallengeToken: challengeToken,
    mfaCodeHash: hashOtpCode(code),
    mfaCodeExpiresAt: expiresAt,
    mfaCodeAttempts: 0,
  });

  await sendOperationalEmail({
    to: [user.email],
    subject: "Code de verification - Portail Associations",
    text: `Votre code de verification est ${code}. Il expire dans 10 minutes.`,
    html: `
      <div style="font-family: Arial, sans-serif; line-height: 1.5; color: #161616;">
        <h2>Code de verification</h2>
        <p>Utilisez ce code pour finaliser votre connexion au Portail Associations :</p>
        <p style="font-size: 28px; font-weight: 700; letter-spacing: 6px;">${code}</p>
        <p>Ce code expire dans 10 minutes.</p>
      </div>
    `,
  });

  return new MfaChallengeRequiredError("email", challengeToken, expiresAt, maskEmail(user.email));
}

async function signSession(user: User) {
  const expiresAt = Math.floor((Date.now() + ONE_YEAR_MS) / 1000);
  return new SignJWT({
    userId: user.id,
    openId: user.openId,
  } satisfies JwtPayload)
    .setProtectedHeader({ alg: "HS256", typ: "JWT" })
    .setSubject(String(user.id))
    .setExpirationTime(expiresAt)
    .sign(getJwtSecret());
}

async function verifySession(token: string | undefined | null) {
  if (!token) return null;

  try {
    const { payload } = await jwtVerify(token, getJwtSecret(), {
      algorithms: ["HS256"],
    });
    const userId = Number(payload.userId ?? payload.sub);
    const openId = typeof payload.openId === "string" ? payload.openId : "";

    if (!Number.isInteger(userId) || userId <= 0 || !openId) return null;
    return { userId, openId };
  } catch {
    return null;
  }
}

export function setSessionCookie(req: Request, res: Response, token: string) {
  res.cookie(COOKIE_NAME, token, {
    ...getSessionCookieOptions(req),
    maxAge: ONE_YEAR_MS,
  });
}

export function clearSessionCookie(req: Request, res: Response) {
  res.clearCookie(COOKIE_NAME, {
    ...getSessionCookieOptions(req),
    maxAge: -1,
  });
}

export async function registerLocalUser(input: {
  name: string;
  email: string;
  password: string;
}) {
  const email = normalizeEmail(input.email);

  const existing = await db.getUserByEmail(email);

  if (existing) {
    throw new Error("Un compte existe deja avec cette adresse email");
  }

  const bootstrapUser = findBootstrapUserByCredentials(input);
  if (bootstrapUser) {
    return bootstrapUser;
  }

  const role =
    ENV.adminEmail && normalizeEmail(ENV.adminEmail) === email ? "super_admin" : "user";

  await db.upsertUser({
    openId: email,
    name: input.name.trim(),
    email,
    passwordHash: await hashPassword(input.password),
    loginMethod: "local_jwt",
    role,
    lastSignedIn: new Date(),
  });

  const user = await db.getUserByEmail(email);
  if (!user) throw new Error("Impossible de creer le compte utilisateur");

  return user;
}

export async function loginLocalUser(input: { email: string; password: string }) {
  const email = normalizeEmail(input.email);

  const user = await db.getUserByEmail(email);

  if (user) {
    assertUserNotLocked(user);

    if (!(await verifyPassword(input.password, user.passwordHash))) {
      await registerLoginFailure(user);
      throw ForbiddenError("Identifiants invalides");
    }

    await resetLoginSecurityState(user.id);

    if (argon2Async && getPasswordHashAlgorithm(user.passwordHash) === "scrypt") {
      await db.updateUser(user.id, {
        passwordHash: await hashPassword(input.password),
      });
    }

    const refreshedUser = (await db.getUserById(user.id)) ?? user;
    if (getEffectiveMfaMethod(refreshedUser)) {
      throw await sendLoginMfaChallenge(refreshedUser);
    }

    await db.upsertUser({
      openId: user.openId,
      lastSignedIn: new Date(),
    });

    return ensureConfiguredOwnerPrivileges((await db.getUserById(user.id)) ?? refreshedUser);
  }

  const bootstrapUser = findBootstrapUserByCredentials(input);
  if (bootstrapUser) {
    return bootstrapUser;
  }

  throw ForbiddenError("Identifiants invalides");
}

export async function verifyLocalUserMfa(input: { challengeToken: string; code: string }) {
  const user = await db.getUserByMfaChallengeToken(input.challengeToken);
  if (!user) {
    throw ForbiddenError("Verification invalide ou expirée");
  }

  const effectiveMethod = getEffectiveMfaMethod(user);
  if (!effectiveMethod) {
    throw ForbiddenError("Verification invalide ou expirée");
  }

  if (user.mfaCodeExpiresAt && new Date(user.mfaCodeExpiresAt) < new Date()) {
    await db.updateUser(user.id, {
      mfaChallengeToken: null,
      mfaCodeHash: null,
      mfaCodeExpiresAt: null,
      mfaCodeAttempts: 0,
    });
    throw ForbiddenError("Le code de verification a expiré");
  }

  if ((user.mfaCodeAttempts || 0) >= MFA_CODE_ATTEMPT_LIMIT) {
    await db.updateUser(user.id, {
      mfaChallengeToken: null,
      mfaCodeHash: null,
      mfaCodeExpiresAt: null,
      mfaCodeAttempts: 0,
      lockedUntil: new Date(Date.now() + LOGIN_LOCK_DURATION_MS),
    });
    throw new AccountLockedError(new Date(Date.now() + LOGIN_LOCK_DURATION_MS));
  }

  const isValidCode = effectiveMethod === "totp"
    ? verifyTotpCode(decryptSecuritySecret(user.mfaTotpSecretEncrypted), input.code)
    : Boolean(user.mfaCodeHash) && hashOtpCode(input.code.trim()) === user.mfaCodeHash;

  if (!isValidCode) {
    await db.updateUser(user.id, {
      mfaCodeAttempts: (user.mfaCodeAttempts || 0) + 1,
    });
    throw ForbiddenError("Code de verification incorrect");
  }

  await db.updateUser(user.id, {
    mfaChallengeToken: null,
    mfaCodeHash: null,
    mfaCodeExpiresAt: null,
    mfaCodeAttempts: 0,
    lastSignedIn: new Date(),
  });

  return ensureConfiguredOwnerPrivileges((await db.getUserById(user.id)) ?? user);
}

export async function resendLocalUserMfaChallenge(challengeToken: string) {
  const user = await db.getUserByMfaChallengeToken(challengeToken);
  if (!user || getEffectiveMfaMethod(user) !== "email") {
    throw ForbiddenError("Verification invalide ou expirée");
  }

  if (!user.email) {
    throw ForbiddenError("Adresse email indisponible pour ce compte");
  }

  const code = generateOtpCode();
  const expiresAt = new Date(Date.now() + MFA_CODE_TTL_MS);

  await db.updateUser(user.id, {
    mfaCodeHash: hashOtpCode(code),
    mfaCodeExpiresAt: expiresAt,
    mfaCodeAttempts: 0,
  });

  await sendOperationalEmail({
    to: [user.email],
    subject: "Nouveau code de verification - Portail Associations",
    text: `Votre nouveau code de verification est ${code}. Il expire dans 10 minutes.`,
    html: `
      <div style="font-family: Arial, sans-serif; line-height: 1.5; color: #161616;">
        <h2>Nouveau code de verification</h2>
        <p>Utilisez ce code pour finaliser votre connexion au Portail Associations :</p>
        <p style="font-size: 28px; font-weight: 700; letter-spacing: 6px;">${code}</p>
        <p>Ce code expire dans 10 minutes.</p>
      </div>
    `,
  });

  return {
    challengeToken,
    expiresAt,
    maskedEmail: maskEmail(user.email),
  };
}

export async function startAuthenticatorSetup(user: User) {
  if (user.loginMethod !== "local_jwt" || !user.email) {
    throw new Error("Authenticator est disponible uniquement pour les comptes locaux avec email.");
  }

  const secret = generateTotpSecret();
  await db.updateUser(user.id, {
    mfaTotpPendingSecretEncrypted: encryptSecuritySecret(secret),
  });

  return {
    manualEntryKey: secret,
    otpauthUrl: buildOtpAuthUrl(user.email, secret),
  };
}

export async function confirmAuthenticatorSetup(user: User, code: string) {
  const freshUser = await db.getUserById(user.id);
  if (!freshUser) {
    throw new Error("Compte introuvable");
  }
  const pendingSecret = decryptSecuritySecret(freshUser.mfaTotpPendingSecretEncrypted);
  if (!pendingSecret) {
    throw new Error("Aucune configuration Authenticator en attente.");
  }
  if (!verifyTotpCode(pendingSecret, code)) {
    throw new Error("Code Authenticator invalide.");
  }

  await db.updateUser(user.id, {
    mfaEnabled: true,
    mfaMethod: "authenticator_app",
    mfaTotpSecretEncrypted: encryptSecuritySecret(pendingSecret),
    mfaTotpPendingSecretEncrypted: null,
  });
}

export async function cancelAuthenticatorSetup(user: User) {
  await db.updateUser(user.id, {
    mfaTotpPendingSecretEncrypted: null,
  });
}

export async function scheduleAccountDeletion(user: User) {
  if (user.legalHold) {
    throw new Error("Ce compte est actuellement place en conservation legale et ne peut pas etre supprime.");
  }

  const now = new Date();
  const purgeAt = new Date(now.getTime() + 30 * 24 * 60 * 60 * 1000);

  await db.updateUser(user.id, {
    deletionRequestedAt: now,
    purgeScheduledAt: purgeAt,
    isActive: false,
  });

  return { deletionRequestedAt: now, purgeScheduledAt: purgeAt };
}

export async function cancelScheduledAccountDeletion(user: User) {
  await db.updateUser(user.id, {
    deletionRequestedAt: null,
    purgeScheduledAt: null,
    isActive: true,
  });
}

export async function runUserPurgeScheduler() {
  const startedAt = new Date();
  const dueUsers = await db.getUsersScheduledForPurge();
  let purgedUsers = 0;

  for (const user of dueUsers) {
    const association = await db.getAssociationByUserId(user.id);
    if (association) {
      await db.updateAssociation(association.id, {
        sourceDirectoryEntryId: null,
        nomAssociation: `Association supprimée #${association.id}`,
        siret: null,
        rna: null,
        thematique: null,
        adresse: null,
        codePostal: null,
        ville: null,
        telephone: null,
        emailContact: null,
        siteWeb: null,
        facebookUrl: null,
        instagramUrl: null,
        objetAssociation: null,
        nomRepresentant: null,
        fonctionRepresentant: null,
        gouvernance: null,
        profileComplete: false,
        isActive: false,
      });
    }

    await db.updateUser(user.id, {
      openId: `purged:${user.id}:${Date.now()}`,
      name: `Compte supprimé #${user.id}`,
      email: null,
      passwordHash: null,
      isActive: false,
      mfaEnabled: false,
      mfaMethod: null,
      mfaChallengeToken: null,
      mfaCodeHash: null,
      mfaCodeExpiresAt: null,
      mfaCodeAttempts: 0,
      mfaTotpSecretEncrypted: null,
      mfaTotpPendingSecretEncrypted: null,
      purgedAt: new Date(),
      legalHold: false,
      legalHoldReason: null,
    });

    await db.createAuditLog({
      userId: SYSTEM_ACTOR_USER_ID,
      action: "data_purge",
      entityType: "user",
      entityId: user.id,
      details: JSON.stringify({
        event: "DATA_PURGE",
        executedAt: new Date().toISOString(),
        status: "SUCCESS",
        purgeScheduledAt: user.purgeScheduledAt,
      }),
      ipAddress: "system",
    });

    purgedUsers += 1;
  }

  const allUsers = await db.getAllUsers();
  const pendingDeletionCount = allUsers.filter((item) => item.deletionRequestedAt && !item.purgedAt).length;
  const purgedTotalCount = allUsers.filter((item) => item.purgedAt).length;

  await db.setPortalSetting(
    RETENTION_REPORT_SETTING_KEY,
    JSON.stringify({
      generatedAt: new Date().toISOString(),
      startedAt: startedAt.toISOString(),
      reportType: "daily-retention-job",
      purgedUsers,
      pendingDeletionCount,
      purgedTotalCount,
    }),
    "Dernier rapport automatique de retention et purge"
  );

  return {
    generatedAt: new Date().toISOString(),
    purgedUsers,
    pendingDeletionCount,
    purgedTotalCount,
  };
}

export function isAccountLockedError(error: unknown): error is AccountLockedError {
  return error instanceof AccountLockedError;
}

export function isMfaCodeRequiredError(error: unknown): error is MfaChallengeRequiredError {
  return error instanceof MfaChallengeRequiredError;
}

export async function loginOAuthUser(input: {
  provider: "google" | "facebook";
  providerUserId: string;
  email: string;
  name?: string | null;
}) {
  const email = normalizeEmail(input.email);
  const existingByEmail = await db.getUserByEmail(email);
  const openId = existingByEmail?.openId || email || `${input.provider}:${input.providerUserId}`;
  const role = existingByEmail?.role
    ?? (ENV.adminEmail && normalizeEmail(ENV.adminEmail) === email ? "super_admin" : "user");

  await db.upsertUser({
    openId,
    name: input.name?.trim() || existingByEmail?.name || email.split("@")[0] || "Utilisateur",
    email,
    loginMethod: `${input.provider}_oauth`,
    role,
    lastSignedIn: new Date(),
  });

  if (existingByEmail) {
    return ensureConfiguredOwnerPrivileges((await db.getUserById(existingByEmail.id)) ?? existingByEmail);
  }

  const user = await db.getUserByOpenId(openId);
  if (!user) {
    throw new Error("Impossible de finaliser la connexion sociale");
  }

  return ensureConfiguredOwnerPrivileges(user);
}

export async function createSessionToken(user: User) {
  return signSession(user);
}

export async function authenticateRequest(req: Request): Promise<User> {
  const cookies = parseCookies(req.headers.cookie);
  const session = await verifySession(cookies.get(COOKIE_NAME));

  if (!session) {
    throw ForbiddenError("Invalid session cookie");
  }

  const user = await db.getUserById(session.userId);
  const userByOpenId = user ? null : await db.getUserByOpenId(session.openId);
  const bootstrapUser = findBootstrapUserByOpenId(session.openId);

  if (!user && userByOpenId && userByOpenId.isActive) {
    return ensureConfiguredOwnerPrivileges(userByOpenId);
  }

  if (!user && bootstrapUser) {
    return bootstrapUser;
  }

  if (!user || user.openId !== session.openId || !user.isActive) {
    throw ForbiddenError("User not found");
  }

  return ensureConfiguredOwnerPrivileges(user);
}