// src/services/user.ts
import bcrypt from "bcryptjs";
import { prisma } from "../db";

export async function createUser(email: string, password: string) {
  return prisma.user.create({
    data: { email, password: await bcrypt.hash(password, 12) },
  });
}

// src/db/extensions/hash-password.ts
import { Prisma } from "@prisma/client";
import bcrypt from "bcryptjs";

const ROUNDS = 12;

// bcrypt のハッシュは $2a$ / $2b$ / $2y$ で始まる。二重ハッシュの保険。
const looksHashed = (value: string) => /^\$2[aby]\$\d{2}\$/.test(value);

const toHash = async (value: string) =>
  looksHashed(value) ? value : bcrypt.hash(value, ROUNDS);

export const hashPassword = Prisma.defineExtension((client) =>
  client.$extends({
    name: "hashPassword",
    query: {
      user: {
        async create({ args, query }) {
          if (typeof args.data.password === "string") {
            args.data.password = await toHash(args.data.password);
          }
          return query(args);
        },

        async update({ args, query }) {
          // update の値は "文字列" か { set: "文字列" } のどちらか
          const p = args.data.password;
          if (typeof p === "string") {
            args.data.password = await toHash(p);
          } else if (p && typeof p.set === "string") {
            args.data.password = { set: await toHash(p.set) };
          }
          return query(args);
        },

        async upsert({ args, query }) {
          // create と update の両方を持つので両方処理する
          if (typeof args.create.password === "string") {
            args.create.password = await toHash(args.create.password);
          }
          const p = args.update.password;
          if (typeof p === "string") {
            args.update.password = await toHash(p);
          } else if (p && typeof p.set === "string") {
            args.update.password = { set: await toHash(p.set) };
          }
          return query(args);
        },

        async createMany({ args, query }) {
          // createMany の data は配列にも単体にもなる
          const rows = Array.isArray(args.data) ? args.data : [args.data];
          args.data = await Promise.all(
            rows.map(async (row) => ({
              ...row,
              password: typeof row.password === "string"
                ? await toHash(row.password)
                : row.password,
            })),
          );
          return query(args);
        },
      },
    },
  }),
);

// src/db/index.ts
import { PrismaClient } from "@prisma/client";
import { hashPassword } from "./extensions/hash-password";

// 素の new PrismaClient() は外に出さない。出すと抜け道になる。
export const prisma = new PrismaClient().$extends(hashPassword);

await prisma.user.create({
  data: { email: "aoi@example.com", password: "hunter2" },
});
// → DB には $2b$12$... が入る。呼び出し側は平文を渡すだけでよい

export const prisma = new PrismaClient({
  omit: { user: { password: true } }, // 全クエリから除外
}).$extends(hashPassword);

// 照合するときだけ明示的に戻す
const user = await prisma.user.findUnique({
  where: { email },
  omit: { password: false },
});
await bcrypt.compare(input, user.password);

model User {
  id        Int    @id @default(autoincrement())
  email     String                              // 暗号文を入れる
  emailHash String @unique @map("email_hash")   // HMAC-SHA256（検索・一意制約用）
  password  String
}

// src/db/crypto.ts
import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "node:crypto";

const KEY = Buffer.from(process.env.FIELD_ENCRYPTION_KEY!, "base64");  // 32 bytes
const INDEX_KEY = Buffer.from(process.env.BLIND_INDEX_KEY!, "base64"); // 別の鍵にする

export function encrypt(plain: string) {
  const iv = randomBytes(12);
  const cipher = createCipheriv("aes-256-gcm", KEY, iv);
  const body = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
  // "v1:" は鍵ローテーション時に世代を見分けるための目印
  return `v1:${Buffer.concat([iv, cipher.getAuthTag(), body]).toString("base64")}`;
}

export function decrypt(stored: string) {
  if (!stored.startsWith("v1:")) return stored; // 未暗号化の既存データを壊さない
  const raw = Buffer.from(stored.slice(3), "base64");
  const decipher = createDecipheriv("aes-256-gcm", KEY, raw.subarray(0, 12));
  decipher.setAuthTag(raw.subarray(12, 28));
  return Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]).toString("utf8");
}

// 正規化してからハッシュしないと "Aoi@..." と "aoi@..." が別人になる
export const blindIndex = (plain: string) =>
  createHmac("sha256", INDEX_KEY).update(plain.trim().toLowerCase()).digest("hex");

export const encryptEmail = Prisma.defineExtension((client) =>
  client.$extends({
    name: "encryptEmail",
    query: {
      user: {
        async create({ args, query }) {
          if (typeof args.data.email === "string") {
            const plain = args.data.email;
            args.data.email = encrypt(plain);
            args.data.emailHash = blindIndex(plain);
          }
          const user = await query(args);
          return { ...user, email: decrypt(user.email) };
        },

        async findUnique({ args, query }) {
          // where: { email } を where: { emailHash } に差し替える
          if (typeof args.where.email === "string") {
            args.where = { emailHash: blindIndex(args.where.email) };
          }
          const user = await query(args);
          return user ? { ...user, email: decrypt(user.email) } : user;
        },

        async findMany({ args, query }) {
          const users = await query(args);
          return users.map((u) => ({ ...u, email: decrypt(u.email) }));
        },
      },
    },
  }),
);

model User {
  email     String? @unique /// @encrypted
  emailHash String? @unique @map("email_hash") /// @encryption:hash(email)?saltEnv=EMAIL_SALT&outputEncoding=base64
}

const prisma = new PrismaClient().$extends(
  fieldEncryptionExtension({ encryptionKey: env.DATABASE_ENCRYPTION_KEY }),
);

result: {
  user: {
    emailPlain: {
      needs: { email: true },
      compute: (user) => decrypt(user.email),
    },
  },
}

// ❌ user の create 拡張は起動しない（トップレベルの操作は team.create）
await prisma.team.create({
  data: {
    name: "デザイン",
    members: { create: [{ email: "aoi@example.com", password: "hunter2" }] },
  },
});

query: {
  $allModels: {
    async $allOperations({ model, operation, args, query }) {
      // args を深さ優先で辿り、対象フィールドを書き換えてから query(args)
    },
  },
}