package security

import (
	"crypto/pbkdf2"
	"crypto/rand"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/base64"
	"errors"
	"fmt"
	"strconv"
	"strings"
)

// Password policy and KDF constants.
//
// MaxPasswordLength caps the input at 64 characters. The CAVP tested envelope for this module is
// password length 8 to 64, so the cap keeps every hash inside the tested range. It also bounds the
// work a single request can force, which matters because PBKDF2 at a high iteration count is
// intentionally expensive.
//
// PBKDF2Iterations is 600000, the OWASP 2024 floor for PBKDF2 with HMAC SHA 256. SP 800-132 directs
// implementers to maximize the iteration count within tolerable latency, so this exceeds the CAVP
// tested ceiling of 10000 as a deliberate security choice. Document this when answering a FedRAMP
// assessor: the high count is stronger than, not a deviation from, the validated algorithm.
const (
	MaxPasswordLength = 64
	PBKDF2Iterations  = 600000
	pbkdf2KeyLength   = 32
	pbkdf2SaltLength  = 16
	pbkdf2Prefix      = "pbkdf2-sha256"
)

// ErrPasswordTooLong is returned by Hash when the input exceeds MaxPasswordLength. Verify never
// returns it; an over length input simply does not match.
var ErrPasswordTooLong = fmt.Errorf("security: password exceeds %d characters", MaxPasswordLength)

// ErrMalformedHash is returned when a stored encoded hash cannot be parsed.
var ErrMalformedHash = errors.New("security: malformed password hash")

// Hasher hashes and verifies passwords with PBKDF2 HMAC SHA 256 under the FIPS module, applying a
// versioned pepper first. It is pure logic: the only I/O is reading crypto/rand for the salt.
type Hasher struct {
	pepper *Pepper
	iters  int
}

// NewHasher returns a Hasher. Pass PBKDF2Iterations unless a test needs a cheaper cost.
func NewHasher(pepper *Pepper, iters int) (*Hasher, error) {
	if pepper == nil {
		return nil, errors.New("security: hasher needs a pepper")
	}
	if iters <= 0 {
		return nil, errors.New("security: hasher needs a positive iteration count")
	}
	return &Hasher{pepper: pepper, iters: iters}, nil
}

// Hash peppers and derives the password, returning the self describing encoded hash and the pepper
// version it was written with. The caller stores both (the encoded hash and the pepper version
// column).
func (h *Hasher) Hash(password string) (encoded string, pepperVersion int, err error) {
	if len(password) > MaxPasswordLength {
		return "", 0, ErrPasswordTooLong
	}
	version := h.pepper.ActiveVersion()
	peppered, err := h.pepper.Apply(version, password)
	if err != nil {
		return "", 0, err
	}
	salt := make([]byte, pbkdf2SaltLength)
	if _, err := rand.Read(salt); err != nil {
		return "", 0, fmt.Errorf("security: read salt: %w", err)
	}
	dk, err := pbkdf2.Key(sha256.New, string(peppered), salt, h.iters, pbkdf2KeyLength)
	if err != nil {
		return "", 0, fmt.Errorf("security: derive key: %w", err)
	}
	encoded = strings.Join([]string{
		pbkdf2Prefix,
		strconv.Itoa(h.iters),
		base64.RawStdEncoding.EncodeToString(salt),
		base64.RawStdEncoding.EncodeToString(dk),
	}, "$")
	return encoded, version, nil
}

// Verify reports whether password matches the stored encoded hash that was written with
// pepperVersion. needsRehash is true when the match succeeded but the stored parameters (iteration
// count or pepper version) are behind current policy, so the caller should transparently rehash on
// this successful login. The comparison is constant time.
func (h *Hasher) Verify(password, encoded string, pepperVersion int) (ok bool, needsRehash bool, err error) {
	iters, salt, dk, err := parsePBKDF2(encoded)
	if err != nil {
		return false, false, err
	}
	if len(password) > MaxPasswordLength {
		return false, false, nil
	}
	peppered, err := h.pepper.Apply(pepperVersion, password)
	if err != nil {
		return false, false, err
	}
	candidate, err := pbkdf2.Key(sha256.New, string(peppered), salt, iters, len(dk))
	if err != nil {
		return false, false, fmt.Errorf("security: derive key: %w", err)
	}
	if subtle.ConstantTimeCompare(candidate, dk) != 1 {
		return false, false, nil
	}
	needsRehash = iters != h.iters || pepperVersion != h.pepper.ActiveVersion()
	return true, needsRehash, nil
}

// parsePBKDF2 splits the encoded form pbkdf2-sha256$<iters>$<b64salt>$<b64dk>.
func parsePBKDF2(encoded string) (iters int, salt, dk []byte, err error) {
	parts := strings.Split(encoded, "$")
	if len(parts) != 4 || parts[0] != pbkdf2Prefix {
		return 0, nil, nil, ErrMalformedHash
	}
	iters, err = strconv.Atoi(parts[1])
	if err != nil || iters <= 0 {
		return 0, nil, nil, ErrMalformedHash
	}
	salt, err = base64.RawStdEncoding.DecodeString(parts[2])
	if err != nil || len(salt) == 0 {
		return 0, nil, nil, ErrMalformedHash
	}
	dk, err = base64.RawStdEncoding.DecodeString(parts[3])
	if err != nil || len(dk) == 0 {
		return 0, nil, nil, ErrMalformedHash
	}
	return iters, salt, dk, nil
}