"""认证服务：JWT 签发/校验（HS256）+ 密码哈希/校验。

密码用 stdlib PBKDF2（免 bcrypt 依赖），存储格式自描述：
  pbkdf2_sha256$600000$<salt_hex>$<digest_hex>
"""
import hashlib
import hmac
import secrets
import time

import jwt

from config.settings import settings

_ITERATIONS = 600_000


# ---- JWT ----
def create_token(user_id: int, *, extra: dict | None = None) -> str:
    """签发 token：仅存 user_id + iat/exp，用户信息校验时按 id 回查 sys_user。"""
    now = int(time.time())
    payload = {"user_id": user_id, "iat": now, "exp": now + settings.jwt.expire_seconds}
    if extra:
        payload.update(extra)
    return jwt.encode(payload, settings.jwt.secret, algorithm=settings.jwt.algorithm)


def decode_token(token: str) -> dict:
    """校验签名 + 过期，返回 claims；任何失败抛异常（调用方转 401）。"""
    return jwt.decode(token, settings.jwt.secret, algorithms=[settings.jwt.algorithm])


# ---- 密码 ----
def hash_password(password: str) -> str:
    salt = secrets.token_hex(16)
    digest = hashlib.pbkdf2_hmac("sha256", password.encode(), bytes.fromhex(salt), _ITERATIONS)
    return f"pbkdf2_sha256${_ITERATIONS}${salt}${digest.hex()}"


def verify_password(password: str, stored: str) -> bool:
    try:
        _, iters, salt, digest = stored.split("$")
    except ValueError:
        return False
    calc = hashlib.pbkdf2_hmac("sha256", password.encode(), bytes.fromhex(salt), int(iters))
    return hmac.compare_digest(calc.hex(), digest)