import { SessionOptions } from "iron-session";

/** Code de connexion par courriel en attente (stocké chiffré dans le cookie — aucune table nécessaire). */
export interface PendingOtp {
  email: string;      // adresse normalisée (minuscules)
  userId: string;
  hash: string;       // SHA-256(sel:code)
  salt: string;
  expiresAt: number;  // epoch ms
  attempts: number;
  sentAt: number;     // epoch ms — anti-spam de renvoi
}

export interface SessionData {
  isLoggedIn: boolean;
  userId?: string;
  userRole?: string;
  csrfToken?: string;
  pendingTwoFactor?: boolean;
  pendingUserId?: string;
  sessionToken?: string; // ties the cookie to a LoginSession record
  otp?: PendingOtp;
}

export const sessionOptions: SessionOptions = {
  password: process.env.SESSION_SECRET || "spb-cloud-secret-key-change-in-production-min-32-chars",
  cookieName: "spb-cloud-session",
  cookieOptions: {
    secure: process.env.NODE_ENV === "production",
    httpOnly: true,
    sameSite: "lax" as const,
    maxAge: 60 * 60 * 24,
  },
};

export const defaultSession: SessionData = {
  isLoggedIn: false,
};