import crypto from 'crypto';

// Shared primitive for generating and verifying one-time alphanumeric codes.
//
// Uppercase letters + digits, minus visually ambiguous characters (I, O, 0, 1),
// so codes are easy to read from a terminal log and type by hand.
//
// Usage: call createOneTimeCode() to get an independent code instance; each
// instance keeps its own state and can be generated / cleared / compared
// without affecting any other instance.

const ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
const CODE_LENGTH = 10;

export interface OneTimeCode {
  /** Mint a new code, replacing any existing one. Returns the raw code string. */
  generate(): string;
  /** Return the current code, or null if none is active. */
  get(): string | null;
  /** Invalidate the current code. */
  clear(): void;
  /**
   * Constant-time comparison against the active code.
   * Returns false if no code is active or the input is not a matching string.
   */
  matches(provided: unknown): boolean;
}

export function createOneTimeCode(): OneTimeCode {
  let current: string | null = null;

  return {
    generate() {
      const bytes = crypto.randomBytes(CODE_LENGTH);
      let out = '';
      for (let i = 0; i < CODE_LENGTH; i++) {
        out += ALPHABET[bytes[i]! % ALPHABET.length];
      }
      current = out;
      return current;
    },

    get() {
      return current;
    },

    clear() {
      current = null;
    },

    matches(provided: unknown): boolean {
      if (!current || typeof provided !== 'string') return false;
      const a = Buffer.from(current);
      const b = Buffer.from(provided);
      if (a.length !== b.length) return false;
      return crypto.timingSafeEqual(a, b);
    },
  };
}