import { createOneTimeCode } from './one-time-code.js';

// One-time password-reset code.
//
// POST /api/auth/forgot-password mints a reset code and logs it. The operator
// reads the code from the server logs and enters it on the reset form to set a
// new password without an active session. Requesting a new code invalidates any
// previous one. The code is cleared after a successful reset.

const _code = createOneTimeCode();
const RESET_CODE_TTL_MS = 15 * 60 * 1000; // 15 minutes
let mintedAtMs = 0;

// Mint a fresh reset code and log it prominently. Returns the code.
export function generateResetCode(): string {
  const code = _code.generate();
  mintedAtMs = Date.now();
  console.log('');
  console.log('  Password-reset code: ' + code);
  console.log('  Enter this code on the reset form to set a new password.');
  console.log('');
  return code;
}

export function getResetCode(): string | null {
  return _code.get();
}

export function clearResetCode(): void {
  _code.clear();
  mintedAtMs = 0;
}

// Constant-time comparison against the active code. Returns false when no code
// is active or the input is not a matching string.
export function resetCodeMatches(provided: unknown): boolean {
  if (!mintedAtMs) return false;
  if (Date.now() - mintedAtMs > RESET_CODE_TTL_MS) {
    clearResetCode();
    return false;
  }
  return _code.matches(provided);
}