//go:build dev || test

package user

// Dev/test builds (the `dev` tag, or any build with the `test` tag) deliver 2FA
// codes to the LOCAL DEV stdout log ([2FA] prefix) as the stand-in for the
// not-yet-wired email/SMS transport (P6), and a missing TWO_FACTOR_PEPPER still
// falls back to the legacy unsalted SHA-256 digest. Production builds
// (!dev && !test) instead NEVER log the code — log delivery is a dev/test-only
// local feature, never a production channel — and fail closed without the
// pepper — see twofa_prod.go.

import (
	"crussell/internal/twofa"
	"log"
	"os"
	"sync"
)

// twoFAPepperWarnOnce guards the one-time warning when TWO_FACTOR_PEPPER is
// unset, so a misconfigured deployment is loudly flagged once rather than on
// every code operation. Dev/test only: production builds fail closed at
// issuance instead.
var twoFAPepperWarnOnce sync.Once

// init registers the dev/test pepper reader into the shared verification core
// (crussell/internal/twofa): the documented loose-fake fallback — the legacy
// unsalted SHA-256 digest with a one-time warning when TWO_FACTOR_PEPPER is
// unset. Production builds fail closed instead (twofa_prod.go).
func init() {
	twofa.SetPepperProvider(func() string {
		pepper := os.Getenv(twoFAPepperEnv)
		if pepper == "" {
			twoFAPepperWarnOnce.Do(func() {
				log.Printf("WARNING: TWO_FACTOR_PEPPER unset — 2FA codes hashed without an HMAC pepper (falling back to unsalted SHA-256); set TWO_FACTOR_PEPPER in production so a leaked digest cannot be brute-forced offline")
			})
		}
		return pepper
	})
}

// twoFAEnsureIssueAllowed always permits code issuance in dev/test builds: the
// loose-fake delivery (the [2FA] log line) is the documented stand-in until the
// email/SMS transport is wired (P6). Production builds fail closed here — no
// TWO_FACTOR_PEPPER, no codes (see twofa_prod.go).
func twoFAEnsureIssueAllowed() error { return nil }

// twoFADeliverCode delivers a fresh verification code to the user. Dev/test:
// the [2FA] log line is the LOCAL DEV delivery channel — an operator (or the
// developer) relays the code to the user out-of-band until email/SMS lands
// (P6). Production builds NEVER log it (see twofa_prod.go) and refuse issuance
// up front — stdout-log delivery is a dev/test-only feature.
//
// MEDIUM-3b: the user id and the plaintext code are written to SEPARATE log
// lines so a log line cannot trivially pair a code with its owner. The two
// lines are still correlated by proximity, but a single-line grep or a log
// redaction rule that masks a "code" pattern no longer discloses the identity
// in the same record.
func twoFADeliverCode(userID, label, code string) {
	log.Printf("[2FA] code delivery requested (user=%s, purpose=%s)", userID, label)
	log.Printf("[2FA] code: %s", code)
}

// twoFADeliveryAvailable reports whether a 2FA code delivery channel exists in
// this build. Dev/test: always true — the [2FA] log line is the delivery
// channel. Production builds only have a channel when the operator explicitly
// opted into log delivery or a real email/SMS transport is wired (P6) — see
// twofa_prod.go.
func twoFADeliveryAvailable() bool { return true }