<?php
declare(strict_types=1);

/** Email self-registration (verify link). TOTP enrollment follows login — task 3.x. */
final class AuthRegistration {
    private const TOKEN_TTL_S = 86400;

    private function __construct() {
    }

    public static function ensureSchema(): void {
        AuthEmailSchema::ensure(Database::pdo());
    }

    /** @return array{ok:bool,error?:string} */
    public static function register(string $email, string $password, string $username = ''): array {
        self::ensureSchema();
        if (AuthAttempts::isRateLimited($username !== '' ? $username : $email)) {
            return ['ok' => false, 'error' => 'rate_limited'];
        }
        $emailNorm = self::normalizeEmail($email);
        if ($emailNorm === '' || !filter_var($emailNorm, FILTER_VALIDATE_EMAIL)) {
            AuthAttempts::record('register_fail', $username ?: $email);
            return ['ok' => false, 'error' => 'invalid_email'];
        }
        if (strlen($password) < 10) {
            AuthAttempts::record('register_fail', $username ?: $email);
            return ['ok' => false, 'error' => 'weak_password'];
        }
        $username = trim($username);
        if ($username === '') {
            $username = strstr($emailNorm, '@', true) ?: $emailNorm;
        }
        $pdo = Database::pdo();
        $st = $pdo->prepare('SELECT id FROM users WHERE email_normalized = ? OR username = ? LIMIT 1');
        $st->execute([$emailNorm, $username]);
        if ($st->fetchColumn()) {
            AuthAttempts::record('register_fail', $username);
            return ['ok' => false, 'error' => 'already_registered'];
        }
        $hash = password_hash($password, PASSWORD_DEFAULT);
        $pdo->prepare(
            'INSERT INTO users (username, password_hash, role, email_normalized, status) VALUES (?, ?, ?, ?, ?)'
        )->execute([
            $username,
            $hash,
            'viewer',
            $emailNorm,
            'pending',
        ]);
        $userId = (int) $pdo->lastInsertId();
        $token = bin2hex(random_bytes(32));
        $tokenHash = hash('sha256', $token);
        $expires = date('Y-m-d H:i:s', time() + self::TOKEN_TTL_S);
        $pdo->prepare(
            'INSERT INTO auth_tokens (user_id, purpose, token_hash, email_normalized, expires_at, created_at)
             VALUES (?, ?, ?, ?, ?, ?)'
        )->execute([$userId, 'verify_email', $tokenHash, $emailNorm, $expires, date('Y-m-d H:i:s')]);
        $base = rtrim((string) cfg('base_path', ''), '/');
        $verifyUrl = 'https://apps.f0xx.org' . $base . '/verify-email?token=' . urlencode($token);
        if (!AuthMailer::sendVerifyEmail($emailNorm, $verifyUrl)) {
            error_log('AuthRegistration: verify mail failed for ' . $emailNorm);
        }
        AuthAttempts::record('register_ok', $username);
        return ['ok' => true];
    }

    /** @return array{ok:bool,error?:string} */
    public static function verifyEmailToken(string $token): array {
        self::ensureSchema();
        $token = trim($token);
        if ($token === '') {
            return ['ok' => false, 'error' => 'missing_token'];
        }
        $hash = hash('sha256', $token);
        $pdo = Database::pdo();
        $st = $pdo->prepare(
            "SELECT * FROM auth_tokens WHERE token_hash = ? AND purpose = 'verify_email' AND used_at IS NULL LIMIT 1"
        );
        $st->execute([$hash]);
        $row = $st->fetch(PDO::FETCH_ASSOC);
        if (!$row) {
            return ['ok' => false, 'error' => 'invalid_token'];
        }
        $exp = strtotime((string) ($row['expires_at'] ?? ''));
        if ($exp !== false && $exp < time()) {
            return ['ok' => false, 'error' => 'expired_token'];
        }
        $userId = (int) ($row['user_id'] ?? 0);
        $now = date('Y-m-d H:i:s');
        $pdo->prepare('UPDATE auth_tokens SET used_at = ? WHERE id = ?')->execute([$now, (int) $row['id']]);
        $pdo->prepare(
            "UPDATE users SET email_verified_at = ?, status = 'active' WHERE id = ?"
        )->execute([$now, $userId]);
        return ['ok' => true];
    }

    private static function normalizeEmail(string $email): string {
        return strtolower(trim($email));
    }
}