from flask import session

from max.db import get_user_by_email
from max.translations import t

from .hashing import BLF_CRYPT_PREFIX, check_password
from .passwords import rehash_password_if_needed

# Hash of a random, unknown password. It is checked for unknown users, so the
# response time does not tell whether an email exists.
DUMMY_HASH = (
    BLF_CRYPT_PREFIX + "$2b$12$J27D9dEpQ5ff/I48HG05p.97oJGTO7UiaKGIbVuzV6nw0lo6gZ5wq"
)

LOGIN_FAILED_MESSAGE = "Email or password is wrong, or the account is deactivated"


def login(email, password):
    if not isinstance(email, str) or not isinstance(password, str):
        return t(LOGIN_FAILED_MESSAGE)
    if not email or not password:
        return t(LOGIN_FAILED_MESSAGE)

    user = get_user_by_email(email)
    if user is None:
        check_password(password, DUMMY_HASH)
        return t(LOGIN_FAILED_MESSAGE)

    if not check_password(password, user.passwordhash):
        return t(LOGIN_FAILED_MESSAGE)

    if not user.enabled:
        return t(LOGIN_FAILED_MESSAGE)

    rehash_password_if_needed(user, password)

    # Start a new session (new id, new CSRF token) against session fixation.
    session.clear()
    session["user_id"] = user.id
    return None


def logout():
    session.clear()