package com.prudas.app.security;

import com.prudas.app.config.AppProperties;
import com.prudas.app.entity.AdminUser;
import com.prudas.app.repository.AdminUserRepository;
import lombok.RequiredArgsConstructor;
import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Transactional;

import java.time.Instant;
import java.time.temporal.ChronoUnit;

/**
 * Account lockout after repeated failed logins (OWASP ASVS 2.2.1). Tracks
 * state on the AdminUser row itself rather than in memory so lockout
 * survives an application restart and works correctly if you ever scale
 * the backend to multiple instances.
 */
@Component
@RequiredArgsConstructor
public class LoginAttemptService {

    private final AdminUserRepository repository;
    private final AppProperties appProperties;

    @Transactional
    public void onSuccessfulLogin(AdminUser user) {
        user.setFailedLoginAttempts(0);
        user.setLockedUntil(null);
        repository.save(user);
    }

    @Transactional
    public void onFailedLogin(AdminUser user) {
        int attempts = user.getFailedLoginAttempts() + 1;
        user.setFailedLoginAttempts(attempts);
        if (attempts >= appProperties.security().maxLoginAttempts()) {
            user.setLockedUntil(Instant.now().plus(appProperties.security().lockoutDurationMinutes(), ChronoUnit.MINUTES));
        }
        repository.save(user);
    }
}