import hashlib
import secrets
from datetime import datetime, timedelta, timezone
from base64 import b64encode, b64decode

import jwt
from cryptography.fernet import Fernet

SECRET_KEY = "metafoliador_v2_jwt_secret_change_in_production"
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 480

_fernet_key = b64encode(hashlib.sha256(SECRET_KEY.encode()).digest())
_fernet = Fernet(_fernet_key)


def hash_password(password: str) -> str:
    salt = secrets.token_hex(16)
    h = hashlib.sha256(f"{salt}{password}".encode()).hexdigest()
    return f"{salt}:{h}"


def verify_password(password: str, password_hash: str) -> bool:
    salt, h = password_hash.split(":", 1)
    return hashlib.sha256(f"{salt}{password}".encode()).hexdigest() == h


def encrypt_credential(value: str) -> str:
    if not value:
        return ""
    return b64encode(_fernet.encrypt(value.encode())).decode()


def decrypt_credential(encrypted: str) -> str:
    if not encrypted:
        return ""
    return _fernet.decrypt(b64decode(encrypted.encode())).decode()


def create_access_token(data: dict) -> str:
    to_encode = data.copy()
    expire = datetime.now(timezone.utc) + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    to_encode.update({"exp": expire})
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)


def decode_access_token(token: str) -> dict | None:
    try:
        return jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
    except jwt.PyJWTError:
        return None