// auth.ts - DIY Authentication (good luck)
import bcrypt from 'bcrypt'
import jwt from 'jsonwebtoken'
import { randomBytes } from 'crypto'

const SALT_ROUNDS = 12
const JWT_SECRET = process.env.JWT_SECRET!
const CSRF_SECRET = process.env.CSRF_SECRET!

async function hashPassword(password: string) {
  return bcrypt.hash(password, SALT_ROUNDS)
}

async function verifyPassword(password: string, hash: string) {
  return bcrypt.compare(password, hash)
}

function generateSessionToken() {
  return randomBytes(32).toString('hex')
}

function generateCSRFToken(sessionId: string) {
  return jwt.sign({ sessionId }, CSRF_SECRET, { expiresIn: '1h' })
}

// Rate limiting - you'll need Redis for this
const rateLimiter = new Map<string, number[]>()

function checkRateLimit(ip: string): boolean {
  const now = Date.now()
  const windowMs = 15 * 60 * 1000
  const maxRequests = 100
  // ... this gets complicated fast
  const requests = rateLimiter.get(ip) || []
  const filtered = requests.filter(t => t > now - windowMs)
  if (filtered.length >= maxRequests) return false
  filtered.push(now)
  rateLimiter.set(ip, filtered)
  return true
}

// Don't forget: email verification, password reset,
// MFA, OAuth, session invalidation, account lockout,
// audit logging, webhook events, RBAC...
// Are you sure you want to build all this?

// auth.ts - DIY Authentication (good luck)
import bcrypt from 'bcrypt'
import jwt from 'jsonwebtoken'
import { randomBytes } from 'crypto'

const SALT_ROUNDS = 12
const JWT_SECRET = process.env.JWT_SECRET!
const CSRF_SECRET = process.env.CSRF_SECRET!

async function hashPassword(password: string) {
  return bcrypt.hash(password, SALT_ROUNDS)
}

async function verifyPassword(password: string, hash: string) {
  return bcrypt.compare(password, hash)
}

function generateSessionToken() {
  return randomBytes(32).toString('hex')
}

function generateCSRFToken(sessionId: string) {
  return jwt.sign({ sessionId }, CSRF_SECRET, { expiresIn: '1h' })
}

// Rate limiting - you'll need Redis for this
const rateLimiter = new Map<string, number[]>()

function checkRateLimit(ip: string): boolean {
  const now = Date.now()
  const windowMs = 15 * 60 * 1000
  const maxRequests = 100
  // ... this gets complicated fast
  const requests = rateLimiter.get(ip) || []
  const filtered = requests.filter(t => t > now - windowMs)
  if (filtered.length >= maxRequests) return false
  filtered.push(now)
  rateLimiter.set(ip, filtered)
  return true
}

// Don't forget: email verification, password reset,
// MFA, OAuth, session invalidation, account lockout,
// audit logging, webhook events, RBAC...
// Are you sure you want to build all this?