import { AppError } from './AppError';

export interface PasswordValidationResult {
  valid: boolean;
  errors: string[];
}

export function validatePasswordStrength(password: string): PasswordValidationResult {
  const errors: string[] = [];

  if (password.length < 12) {
    errors.push('At least 12 characters');
  }
  if (!/[a-z]/.test(password)) {
    errors.push('At least one lowercase letter');
  }
  if (!/[A-Z]/.test(password)) {
    errors.push('At least one uppercase letter');
  }
  if (!/[0-9]/.test(password)) {
    errors.push('At least one number');
  }
  if (!/[^A-Za-z0-9]/.test(password)) {
    errors.push('At least one special character');
  }

  return { valid: errors.length === 0, errors };
}

export function assertPasswordStrength(password: string): void {
  const result = validatePasswordStrength(password);
  if (!result.valid) {
    throw new AppError(
      'validation_error',
      400,
      `Password requirements: ${result.errors.join('; ')}.`,
    );
  }
}

/** Notify when password is older than this many days (default 90). */
export const PASSWORD_MAX_AGE_DAYS = 90;

export function passwordAgeDays(changedAt: Date | null | undefined): number | null {
  if (!changedAt) return null;
  return Math.floor((Date.now() - changedAt.getTime()) / (1000 * 60 * 60 * 24));
}

export function isPasswordExpired(changedAt: Date | null | undefined): boolean {
  const age = passwordAgeDays(changedAt);
  if (age === null) return false;
  return age >= PASSWORD_MAX_AGE_DAYS;
}