## Copyright © 2026 Olaf Kolkman
## SPDX-License-Identifier: GPL-3.0-or-later

import base64
import hashlib
import hmac
import secrets
import time
from urllib.parse import quote


def create_secret() -> str:
    return base64.b32encode(secrets.token_bytes(20)).decode('ascii').rstrip('=')


def provisioning_uri(secret: str, username: str, issuer: str = 'LinkLog') -> str:
    return f'otpauth://totp/{quote(issuer)}:{quote(username)}?secret={secret}&issuer={quote(issuer)}'


def current_code(secret: str, timestamp: float | None = None) -> str:
    padded_secret = secret + '=' * (-len(secret) % 8)
    key = base64.b32decode(padded_secret, casefold=True)
    counter = int(timestamp if timestamp is not None else time.time()) // 30
    digest = hmac.new(key, counter.to_bytes(8, 'big'), hashlib.sha1).digest()
    index = digest[-1] & 0x0f
    value = (int.from_bytes(digest[index:index + 4], 'big') & 0x7fffffff) % 1_000_000
    return f'{value:06d}'


def verify_code(secret: str | None, code: str | None) -> bool:
    if not secret or not code:
        return False
    normalized_code = code.strip()
    if len(normalized_code) != 6 or not normalized_code.isdigit():
        return False
    padded_secret = secret + '=' * (-len(secret) % 8)
    try:
        key = base64.b32decode(padded_secret, casefold=True)
    except (ValueError, base64.binascii.Error):
        return False
    counter = int(time.time()) // 30
    for offset in (-1, 0, 1):
        digest = hmac.new(key, (counter + offset).to_bytes(8, 'big'), hashlib.sha1).digest()
        index = digest[-1] & 0x0f
        value = (int.from_bytes(digest[index:index + 4], 'big') & 0x7fffffff) % 1_000_000
        if hmac.compare_digest(f'{value:06d}', normalized_code):
            return True
    return False