"""Autenticación simple para panel de administrador."""

from __future__ import annotations

import hashlib
import hmac
import os
import secrets
import time

ADMIN_PASSWORD = os.environ.get("ADMIN_PASSWORD", "")
TOKEN_TTL_SECONDS = 24 * 60 * 60


def admin_configured() -> bool:
    return bool(ADMIN_PASSWORD)


def verify_password(password: str) -> bool:
    if not ADMIN_PASSWORD:
        return False
    return secrets.compare_digest(password, ADMIN_PASSWORD)


def create_token() -> str:
    ts = str(int(time.time()))
    sig = hmac.new(
        ADMIN_PASSWORD.encode(),
        f"admin:{ts}".encode(),
        hashlib.sha256,
    ).hexdigest()
    return f"{ts}.{sig}"


def verify_token(token: str) -> bool:
    if not ADMIN_PASSWORD or not token:
        return False
    try:
        ts_str, sig = token.split(".", 1)
        ts = int(ts_str)
    except (ValueError, AttributeError):
        return False
    if time.time() - ts > TOKEN_TTL_SECONDS:
        return False
    expected = hmac.new(
        ADMIN_PASSWORD.encode(),
        f"admin:{ts_str}".encode(),
        hashlib.sha256,
    ).hexdigest()
    return secrets.compare_digest(sig, expected)