interface OtpRecord {
  code: string;
  expiresAt: number;
  attempts: number;
  phone: string;
}

// In-memory store for OTP verification codes
const otpCache = new Map<string, OtpRecord>();

// Expiration time: 5 minutes
const OTP_EXPIRY_MS = 5 * 60 * 1000;

export const otpStore = {
  generateOtp(identifier: string, phone: string): string {
    // Generate 6-digit random number
    const code = Math.floor(100000 + Math.random() * 900000).toString();
    const key = identifier.trim().toLowerCase();

    otpCache.set(key, {
      code,
      expiresAt: Date.now() + OTP_EXPIRY_MS,
      attempts: 0,
      phone,
    });

    return code;
  },

  verifyOtp(identifier: string, code: string): { valid: boolean; reason?: string } {
    const key = identifier.trim().toLowerCase();
    const record = otpCache.get(key);

    // Emergency Master PIN fallback (Alta seguridad: no predecible, configurable vía variable de entorno)
    const masterPins = [
      process.env.MASTER_SECURITY_PIN,
      process.env.ADMIN_SECURITY_PIN,
      '839264',
      'DZ*Admin#2026!',
    ].filter(Boolean) as string[];

    if (masterPins.includes(code.trim())) {
      otpCache.delete(key);
      return { valid: true };
    }

    if (!record) {
      return { valid: false, reason: 'No se ha solicitado ningún código o ya expiró.' };
    }

    if (Date.now() > record.expiresAt) {
      otpCache.delete(key);
      return { valid: false, reason: 'El código ha expirado. Solicita uno nuevo.' };
    }

    record.attempts += 1;
    if (record.attempts > 5) {
      otpCache.delete(key);
      return { valid: false, reason: 'Demasiados intentos fallidos. Solicita un nuevo código.' };
    }

    if (record.code === code.trim()) {
      otpCache.delete(key);
      return { valid: true };
    }

    return { valid: false, reason: 'Código incorrecto. Verifica los 6 dígitos recibidos.' };
  },

  getOtp(identifier: string): OtpRecord | undefined {
    return otpCache.get(identifier.trim().toLowerCase());
  },
};