import secrets
import time
from typing import Optional

from .config import settings

# 内存 token 存储：token -> 过期时间（monotonic 秒）。服务重启后失效，需重新登录。
_tokens: dict[str, float] = {}


def create_token() -> str:
    token = secrets.token_hex(32)
    _tokens[token] = time.monotonic() + settings.auth_token_ttl_seconds
    return token


def validate_token(token: Optional[str]) -> bool:
    if not token:
        return False
    expires = _tokens.get(token)
    if expires is None:
        return False
    if time.monotonic() > expires:
        _tokens.pop(token, None)
        return False
    return True


def revoke_token(token: Optional[str]) -> None:
    if token:
        _tokens.pop(token, None)


def verify_credentials(username: str, password: str) -> bool:
    return username == settings.auth_user and password == settings.auth_password