package session

import (
	"sync"
	"time"
)

// limiterBase and limiterCap bound the exponential backoff: 1s, 2s, 4s, ...
// capped at 30s.
const (
	limiterBase = 1 * time.Second
	limiterCap  = 30 * time.Second
	// maxShift keeps 1<<n from overflowing and is already well past the point
	// backoff hits limiterCap, so failures beyond it just stay capped.
	maxShift = 5
)

// Limiter throttles login attempts per key (typically the remote IP) with
// exponential backoff, so password guessing is slow without locking anyone
// out for long. It never expires idle keys on its own; a v1-scale accounts
// file does not make that worth the complexity.
type Limiter struct {
	mu    sync.Mutex
	state map[string]*limiterState
}

type limiterState struct {
	failures     int
	blockedUntil time.Time
}

// NewLimiter returns an empty limiter.
func NewLimiter() *Limiter {
	return &Limiter{state: map[string]*limiterState{}}
}

// Allow reports whether key may attempt a login right now.
func (l *Limiter) Allow(key string) bool {
	l.mu.Lock()
	defer l.mu.Unlock()
	st, ok := l.state[key]
	if !ok {
		return true
	}
	return !time.Now().Before(st.blockedUntil)
}

// Fail records a failed attempt for key and returns the backoff before the
// next one is allowed.
func (l *Limiter) Fail(key string) time.Duration {
	l.mu.Lock()
	defer l.mu.Unlock()
	st, ok := l.state[key]
	if !ok {
		st = &limiterState{}
		l.state[key] = st
	}
	st.failures++
	shift := st.failures - 1
	if shift > maxShift {
		shift = maxShift
	}
	backoff := limiterBase * time.Duration(1<<shift)
	if backoff > limiterCap {
		backoff = limiterCap
	}
	st.blockedUntil = time.Now().Add(backoff)
	return backoff
}

// Reset clears key's failure history after a successful login.
func (l *Limiter) Reset(key string) {
	l.mu.Lock()
	delete(l.state, key)
	l.mu.Unlock()
}