import '../../core/security/pin_hasher.dart';
import '../../domain/entities/store_account.dart';
import 'app_database.dart';
import 'catalogue_dao.dart';
import 'staff_dao.dart';

/// The PIN that authorises removing a rung item from a bill.
///
/// Set once by an admin and handed to whoever is on the counter, so a cashier
/// can void a line without an admin walking over. It is a *separate* secret
/// from staff PINs on purpose: a staff PIN identifies a person and is what
/// stamps a bill, and sharing one to allow voids would put every sale that
/// shift under the wrong name.
///
/// Stored hashed with its own salt, never in the clear. Until an admin sets
/// one, [verify] falls back to any admin's staff PIN — a terminal that cannot
/// void at all is worse than one that needs the admin present.
class VoidPinStore {
  const VoidPinStore(this._meta, this._staff);

  final CatalogueDao _meta;
  final StaffDao _staff;

  /// Whether an admin has set a dedicated removal PIN on this terminal.
  ///
  /// Empty counts as absent: [clearPin] blanks the row rather than deleting
  /// it, so a null check alone would report a cleared PIN as still set.
  Future<bool> get isConfigured async {
    final hash = await _meta.meta(MetaKeys.voidPinHash);
    return hash != null && hash.isNotEmpty;
  }

  Future<void> setPin(String pin) async {
    _assertAcceptable(pin);
    final salt = PinHasher.newSalt();
    await _meta.setMeta(MetaKeys.voidPinHash, PinHasher.hash(pin, salt));
    await _meta.setMeta(MetaKeys.voidPinSalt, salt);
  }

  /// Drops the dedicated PIN, returning the terminal to admin-PIN-only voids.
  Future<void> clearPin() async {
    await _meta.setMeta(MetaKeys.voidPinHash, '');
    await _meta.setMeta(MetaKeys.voidPinSalt, '');
  }

  /// True when [pin] may authorise a removal.
  ///
  /// Checks the dedicated PIN first, then admin staff PINs. An admin's own PIN
  /// always works, so setting a removal PIN never locks the owner out of their
  /// own till.
  Future<bool> verify(String pin) async {
    final hash = await _meta.meta(MetaKeys.voidPinHash);
    final salt = await _meta.meta(MetaKeys.voidPinSalt);

    if (hash != null && hash.isNotEmpty && salt != null && salt.isNotEmpty) {
      if (PinHasher.verify(pin, salt: salt, hash: hash)) return true;
    }

    final user = await _staff.authenticate(pin);
    return user != null && user.role == StaffRole.admin;
  }

  /// Same rule the staff PINs use, for the same reason: these are typed on a
  /// keypad behind a counter, in front of a queue.
  static void _assertAcceptable(String pin) {
    if (pin.length < 4 || int.tryParse(pin) == null) {
      throw const VoidPinException('A PIN must be at least four digits.');
    }
    const tooObvious = {'0000', '1111', '2222', '3333', '4444', '5555', '6666',
      '7777', '8888', '9999', '1234', '4321', '0123',};
    if (tooObvious.contains(pin)) {
      throw const VoidPinException(
        'That PIN is too easy to guess from across the counter. '
        'Choose another.',
      );
    }
  }
}

class VoidPinException implements Exception {
  const VoidPinException(this.message);

  final String message;

  @override
  String toString() => message;
}