<?php

declare(strict_types=1);

namespace Steuerkram;

class Auth
{
    private const SESSION_LIFETIME = 86400; // 24 h absolutes Timeout

    public static function require(): void
    {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }

        $userId    = $_SESSION['user_id']    ?? null;
        $loginTime = $_SESSION['login_time'] ?? 0;

        if (!$userId || (time() - (int)$loginTime) > self::SESSION_LIFETIME) {
            $_SESSION = [];
            session_destroy();
            View::redirect('/login');
        }
    }

    public static function login(int $userId): void
    {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
        session_regenerate_id(true);
        $_SESSION['user_id']    = $userId;
        $_SESSION['login_time'] = time();
    }

    public static function logout(): void
    {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
        $_SESSION = [];
        if (ini_get('session.use_cookies')) {
            $p = session_get_cookie_params();
            setcookie(session_name(), '', time() - 42000,
                $p['path'], $p['domain'], $p['secure'], $p['httponly']);
        }
        session_destroy();
    }

    public static function userId(): ?int
    {
        return isset($_SESSION['user_id']) ? (int)$_SESSION['user_id'] : null;
    }

    public static function generateCsrfToken(): string
    {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
        if (empty($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
        return $_SESSION['csrf_token'];
    }

    public static function validateCsrfToken(string $token): void
    {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
        $stored = $_SESSION['csrf_token'] ?? '';
        if ($stored === '' || !hash_equals($stored, $token)) {
            http_response_code(403);
            exit('CSRF-Token ungültig.');
        }
    }
}