//go:build dev || test

package user

// Dev/test builds (the `dev` tag, or any build with the `test` tag) keep the
// documented loose-fake 2FA delivery: the plaintext code is written to the
// server log ([2FA] prefix) as the stand-in for the not-yet-wired email/SMS
// transport (P6), and a missing TWO_FACTOR_PEPPER still falls back to the
// legacy unsalted SHA-256 digest. Production builds (!dev && !test) instead
// never log the code and fail closed without the pepper — see twofa_prod.go.

import (
	"log"
	"os"
	"sync"
)

// twoFAPepperWarnOnce guards the one-time warning when TWO_FACTOR_PEPPER is
// unset, so a misconfigured deployment is loudly flagged once rather than on
// every code operation. Dev/test only: production builds fail closed at
// issuance instead.
var twoFAPepperWarnOnce sync.Once

// twoFAPepper returns the configured HMAC pepper, or "" when unset, logging the
// documented one-time warning. Read per call (the rest of the backend reads env
// vars per call too) so a value provisioned at runtime is picked up; only the
// warning is gated on sync.Once.
func twoFAPepper() string {
	pepper := os.Getenv(twoFAPepperEnv)
	if pepper == "" {
		twoFAPepperWarnOnce.Do(func() {
			log.Printf("WARNING: TWO_FACTOR_PEPPER unset — 2FA codes hashed without an HMAC pepper (falling back to unsalted SHA-256); set TWO_FACTOR_PEPPER in production so a leaked digest cannot be brute-forced offline")
		})
	}
	return pepper
}

// twoFAEnsureIssueAllowed always permits code issuance in dev/test builds: the
// loose-fake delivery (the [2FA] log line) is the documented stand-in until the
// email/SMS transport is wired (P6). Production builds fail closed here — no
// TWO_FACTOR_PEPPER, no codes (see twofa_prod.go).
func twoFAEnsureIssueAllowed() error { return nil }

// twoFADeliverCode delivers a fresh verification code to the user. Dev/test:
// the [2FA] log line is the delivery channel — an operator relays the code to
// the user out-of-band until email/SMS lands. Production builds log it ONLY
// when the operator explicitly opts in via TWO_FACTOR_ALLOW_LOG_DELIVERY=true
// (see twofa_prod.go); otherwise they refuse issuance up front.
func twoFADeliverCode(userID, label, code string) {
	log.Printf("[2FA] verification code for user %s (%s): %s", userID, label, code)
}

// twoFADeliveryAvailable reports whether a 2FA code delivery channel exists in
// this build. Dev/test: always true — the [2FA] log line is the delivery
// channel. Production builds only have a channel when the operator explicitly
// opted into log delivery or a real email/SMS transport is wired (P6) — see
// twofa_prod.go.
func twoFADeliveryAvailable() bool { return true }