package stock

import (
	"context"
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"math/big"
	"sync"
	"time"

	"github.com/redis/go-redis/v9"
)

// StockPartitionConfig holds configuration for stock partitioning.
type StockPartitionConfig struct {
	TotalStock      int           // Total stock across all buckets
	NumBuckets      int           // Number of buckets to partition into
	StockPerBucket  int           // Stock per bucket (TotalStock / NumBuckets)
	BucketKeyPrefix string        // Redis key prefix for buckets
	TotalStockKey   string        // Redis key for total remaining stock (informational)
	LuaScriptHash   string        // SHA of the loaded Lua script
	OperationTimeout time.Duration
}

// DefaultStockPartitionConfig returns a sensible default configuration.
func DefaultStockPartitionConfig(totalStock, numBuckets int) *StockPartitionConfig {
	if numBuckets <= 0 {
		numBuckets = 10
	}
	return &StockPartitionConfig{
		TotalStock:       totalStock,
		NumBuckets:       numBuckets,
		StockPerBucket:   totalStock / numBuckets,
		BucketKeyPrefix:  "flash:sale:bucket",
		TotalStockKey:    "flash:sale:total_remaining",
		OperationTimeout: 5 * time.Second,
	}
}

// BucketResult represents the result of a stock decrement operation.
type BucketResult struct {
	Success      bool
	BucketIndex  int
	Remaining    int
	ErrorMessage string
}

// StockPartitionManager manages partitioned stock with sequential bucket fallback.
type StockPartitionManager struct {
	config     *StockPartitionConfig
	rdb        *redis.Client
	luaScript  string
	scriptHash string
	mu         sync.RWMutex
}

// NewStockPartitionManager creates a new StockPartitionManager and loads the Lua script.
func NewStockPartitionManager(ctx context.Context, rdb *redis.Client, config *StockPartitionConfig) (*StockPartitionManager, error) {
	m := &StockPartitionManager{
		config: config,
		rdb:    rdb,
	}

	// Preload the Lua script for atomic stock decrement with bucket fallback.
	m.luaScript = `
-- KEYS[1]: first bucket key to try
-- KEYS[2..N]: fallback bucket keys
-- ARGV[1]: quantity to decrement
-- ARGV[2]: bucket count (N)

local quantity = tonumber(ARGV[1])
local bucket_count = tonumber(ARGV[2])

for i = 1, bucket_count do
    local stock = redis.call("GET", KEYS[i])
    if stock and tonumber(stock) >= quantity then
        local remaining = redis.call("DECRBY", KEYS[i], quantity)
        -- Also decrement the total stock counter
        local total_key = KEYS[bucket_count + 1]
        redis.call("DECRBY", total_key, quantity)
        return {1, i - 1, remaining}
    end
end

return {0, -1, 0}
`

	hash, err := rdb.ScriptLoad(ctx, m.luaScript).Result()
	if err != nil {
		return nil, fmt.Errorf("stock partition: load lua script: %w", err)
	}
	m.scriptHash = hash
	return m, nil
}

// ReserveStock attempts to decrement stock from a bucket. It selects a primary
// bucket based on the device fingerprint hash, then falls through to subsequent
// buckets if the primary is exhausted.
func (m *StockPartitionManager) ReserveStock(ctx context.Context, deviceFP string, quantity int) (*BucketResult, error) {
	if quantity <= 0 {
		return nil, fmt.Errorf("stock partition: invalid quantity %d", quantity)
	}

	primaryBucket := m.selectBucket(deviceFP)
	keys := make([]string, 0, m.config.NumBuckets+1)

	for i := 0; i < m.config.NumBuckets; i++ {
		bucketIdx := (primaryBucket + i) % m.config.NumBuckets
		keys = append(keys, fmt.Sprintf("%s:%d", m.config.BucketKeyPrefix, bucketIdx))
	}
	// Append the total stock key as the last key for Lua script.
	keys = append(keys, m.config.TotalStockKey)

	ctx, cancel := context.WithTimeout(ctx, m.config.OperationTimeout)
	defer cancel()

	result, err := m.rdb.EvalSha(ctx, m.scriptHash, keys, quantity, len(keys)-1).Result()
	if err != nil {
		return nil, fmt.Errorf("stock partition: evalsha: %w", err)
	}

	vals, ok := result.([]interface{})
	if !ok || len(vals) < 3 {
		return nil, fmt.Errorf("stock partition: unexpected redis response: %v", result)
	}

	success, _ := vals[0].(int64)
	bucketIdx, _ := vals[1].(int64)
	remaining, _ := vals[2].(int64)

	if success == 0 {
		return &BucketResult{Success: false, BucketIndex: -1, Remaining: 0, ErrorMessage: "OUT_OF_STOCK"}, nil
	}

	return &BucketResult{
		Success:     true,
		BucketIndex: int(bucketIdx),
		Remaining:   int(remaining),
	}, nil
}

// selectBucket deterministically maps a device fingerprint to a primary bucket.
func (m *StockPartitionManager) selectBucket(deviceFP string) int {
	if deviceFP == "" {
		// Fallback to random if no fingerprint available.
		n, _ := rand.Int(rand.Reader, big.NewInt(int64(m.config.NumBuckets)))
		return int(n.Int64())
	}

	// Simple hash-based bucket selection.
	hash := 0
	for _, c := range deviceFP {
		hash = hash*31 + int(c)
	}
	if hash < 0 {
		hash = -hash
	}
	return hash % m.config.NumBuckets
}

// InitializeBuckets sets the initial stock for all buckets. Must be called before the flash sale starts.
func (m *StockPartitionManager) InitializeBuckets(ctx context.Context) error {
	pipe := m.rdb.Pipeline()

	for i := 0; i < m.config.NumBuckets; i++ {
		key := fmt.Sprintf("%s:%d", m.config.BucketKeyPrefix, i)
		pipe.Set(ctx, key, m.config.StockPerBucket, 24*time.Hour)
	}
	pipe.Set(ctx, m.config.TotalStockKey, m.config.TotalStock, 24*time.Hour)

	_, err := pipe.Exec(ctx)
	if err != nil {
		return fmt.Errorf("stock partition: init buckets: %w", err)
	}
	return nil
}

// RemainingStock returns the total remaining stock across all buckets (best-effort informational).
func (m *StockPartitionManager) RemainingStock(ctx context.Context) (int, error) {
	val, err := m.rdb.Get(ctx, m.config.TotalStockKey).Int()
	if err != nil {
		if err == redis.Nil {
			return 0, nil
		}
		return 0, fmt.Errorf("stock partition: get remaining: %w", err)
	}
	return val, nil
}

// GenerateDeviceFingerprint creates a unique device fingerprint for testing.
func GenerateDeviceFingerprint() string {
	b := make([]byte, 16)
	rand.Read(b)
	return hex.EncodeToString(b)
}

package waitingroom

import (
	"context"
	"fmt"
	"math"
	"time"

	"github.com/redis/go-redis/v9"
)

// WaitingRoomConfig holds configuration for the virtual waiting room.
type WaitingRoomConfig struct {
	// MaxCapacity is the maximum number of concurrent users in the system.
	MaxCapacity int
	// AdmissionRate is the number of users admitted per second.
	AdmissionRate float64
	// TokenExpiry is how long a token is valid after admission.
	TokenExpiry time.Duration
	// QueueKeyPrefix is the Redis key prefix for the waiting queue.
	QueueKeyPrefix string
}

// DefaultWaitingRoomConfig returns sensible defaults.
func DefaultWaitingRoomConfig() *WaitingRoomConfig {
	return &WaitingRoomConfig{
		MaxCapacity:   1000,
		AdmissionRate: 100.0,
		TokenExpiry:   30 * time.Second,
		QueueKeyPrefix: "flash:waitingroom",
	}
}

// Token represents an admission token.
type Token struct {
	UserID    string    `json:"user_id"`
	DeviceFP  string    `json:"device_fp"`
	Position  int64     `json:"position"`
	GrantedAt time.Time `json:"granted_at"`
	ExpiresAt time.Time `json:"expires_at"`
}

// AdmissionStatus represents the current status of a user in the waiting room.
type AdmissionStatus struct {
	Status      string // "admitted", "waiting", "rejected"
	Position    int64
	Token       string
	WaitTimeSec int
}

// WaitingRoom manages the virtual queue using Redis sorted sets.
type WaitingRoom struct {
	config *WaitingRoomConfig
	rdb    *redis.Client
}

// NewWaitingRoom creates a new WaitingRoom.
func NewWaitingRoom(rdb *redis.Client, config *WaitingRoomConfig) *WaitingRoom {
	return &WaitingRoom{
		config: config,
		rdb:    rdb,
	}
}

// Enqueue adds a user to the waiting queue and returns their position.
func (w *WaitingRoom) Enqueue(ctx context.Context, userID, deviceFP string) (*AdmissionStatus, error) {
	queueKey := w.config.QueueKeyPrefix + ":queue"
	activeKey := w.config.QueueKeyPrefix + ":active"
	now := float64(time.Now().UnixNano())

	// Check if already admitted.
	active, err := w.rdb.ZScore(ctx, activeKey, userID).Result()
	if err == nil {
		expiry := time.Unix(0, int64(active))
		if time.Until(expiry) > 0 {
			return &AdmissionStatus{
				Status:   "admitted",
				Position: 0,
				Token:    fmt.Sprintf("tok_%s_%d", userID, now),
			}, nil
		}
		// Expired token, remove from active set.
		w.rdb.ZRem(ctx, activeKey, userID)
	}

	// Add to queue with priority = timestamp (FIFO).
	member := fmt.Sprintf("%s:%s", userID, deviceFP)
	if err := w.rdb.ZAdd(ctx, queueKey, redis.Z{
		Score:  now,
		Member: member,
	}).Err(); err != nil {
		return nil, fmt.Errorf("waitingroom: enqueue: %w", err)
	}

	// Get position (rank is 0-based, we want 1-based).
	rank, err := w.rdb.ZRank(ctx, queueKey, member).Result()
	if err != nil {
		return nil, fmt.Errorf("waitingroom: get rank: %w", err)
	}

	// Estimate wait time.
	waitTimeSec := int(math.Ceil(float64(rank) / w.config.AdmissionRate))

	return &AdmissionStatus{
		Status:      "waiting",
		Position:    rank + 1, // 1-based position
		WaitTimeSec: waitTimeSec,
	}, nil
}

// AdmitNext admits the next batch of users from the queue based on admission rate.
// Returns the list of admitted user IDs.
func (w *WaitingRoom) AdmitNext(ctx context.Context) ([]string, error) {
	queueKey := w.config.QueueKeyPrefix + ":queue"
	activeKey := w.config.QueueKeyPrefix + ":active"

	// Get current active count.
	activeCount, err := w.rdb.ZCard(ctx, activeKey).Result()
	if err != nil {
		return nil, fmt.Errorf("waitingroom: get active count: %w", err)
	}

	slotsAvailable := int64(w.config.MaxCapacity) - activeCount
	if slotsAvailable <= 0 {
		return nil, nil
	}

	batchSize := int64(math.Min(float64(slotsAvailable), w.config.AdmissionRate))
	if batchSize <= 0 {
		return nil, nil
	}

	// Pop the first N members from the queue.
	results, err := w.rdb.ZPopMin(ctx, queueKey, batchSize).Result()
	if err != nil {
		return nil, fmt.Errorf("waitingroom: pop min: %w", err)
	}

	admitted := make([]string, 0, len(results))
	pipe := w.rdb.Pipeline()
	now := time.Now()

	for _, z := range results {
		member, ok := z.Member.(string)
		if !ok {
			continue
		}
		userID := extractUserID(member)
		admitted = append(admitted, userID)

		pipe.ZAdd(ctx, activeKey, redis.Z{
			Score:  float64(now.Add(w.config.TokenExpiry).UnixNano()),
			Member: userID,
		})
	}

	_, err = pipe.Exec(ctx)
	if err != nil {
		return nil, fmt.Errorf("waitingroom: admit pipeline: %w", err)
	}

	return admitted, nil
}

// Heartbeat refreshes the admission token for an active user.
func (w *WaitingRoom) Heartbeat(ctx context.Context, userID string) error {
	activeKey := w.config.QueueKeyPrefix + ":active"
	now := time.Now()

	return w.rdb.ZAdd(ctx, activeKey, redis.Z{
		Score:  float64(now.Add(w.config.TokenExpiry).UnixNano()),
		Member: userID,
	}).Err()
}

// CleanupExpired removes expired active tokens.
func (w *WaitingRoom) CleanupExpired(ctx context.Context) (int64, error) {
	activeKey := w.config.QueueKeyPrefix + ":active"
	now := float64(time.Now().UnixNano())

	n, err := w.rdb.ZRemRangeByScore(ctx, activeKey, "-inf", fmt.Sprintf("%f", now)).Result()
	if err != nil {
		return 0, fmt.Errorf("waitingroom: cleanup expired: %w", err)
	}
	return n, nil
}

func extractUserID(member string) string {
	for i, c := range member {
		if c == ':' {
			return member[:i]
		}
	}
	return member
}

package ratelimit

import (
	"context"
	"fmt"
	"net/http"
	"strings"
	"sync"
	"time"

	"github.com/redis/go-redis/v9"
)

// SlidingWindowConfig holds configuration for the sliding window rate limiter.
type SlidingWindowConfig struct {
	// WindowSize is the duration of the sliding window (e.g., 1 second).
	WindowSize time.Duration
	// MaxRequests is the maximum number of requests allowed per window.
	MaxRequests int
	// BurstMultiplier is how much burst is allowed over the limit (e.g., 2x).
	BurstMultiplier float64
	// KeyPrefix is the Redis key prefix.
	KeyPrefix string
}

// DefaultSlidingWindowConfig returns sensible defaults for flash sale.
func DefaultSlidingWindowConfig() *SlidingWindowConfig {
	return &SlidingWindowConfig{
		WindowSize:      1 * time.Second,
		MaxRequests:     5,
		BurstMultiplier: 2.0,
		KeyPrefix:       "rl:flash",
	}
}

// DeviceFingerprint extracts a device fingerprint from the HTTP request.
type DeviceFingerprint struct {
	UserAgent      string `json:"user_agent"`
	AcceptLanguage string `json:"accept_language"`
	ScreenWidth    string `json:"screen_width"`
	ScreenHeight   string `json:"screen_height"`
	ColorDepth     string `json:"color_depth"`
	Platform       string `json:"platform"`
	// From client-side JavaScript: navigator.webdriver, canvas fingerprint, etc.
	ClientFingerprint string `json:"client_fp"`
}

// DeviceFingerprintExtractor extracts device fingerprints from HTTP requests.
type DeviceFingerprintExtractor interface {
	Extract(r *http.Request) string
}

type defaultExtractor struct{}

func (e *defaultExtractor) Extract(r *http.Request) string {
	// First check for client-provided fingerprint (from JavaScript).
	clientFP := r.Header.Get("X-Device-Fingerprint")
	if clientFP != "" {
		return clientFP
	}

	// Fallback to server-side fingerprint.
	parts := []string{
		r.Header.Get("User-Agent"),
		r.Header.Get("Accept-Language"),
		r.Header.Get("Accept-Encoding"),
		r.Header.Get("Sec-CH-UA-Platform"),
		r.Header.Get("Sec-CH-UA-Model"),
		r.RemoteAddr,
	}
	return strings.Join(parts, "|")
}

// RateLimiter implements a sliding window rate limiter.
type RateLimiter struct {
	config    *SlidingWindowConfig
	rdb       *redis.Client
	extractor DeviceFingerprintExtractor
	local     sync.Map // local cache for hot path
}

// NewRateLimiter creates a new RateLimiter.
func NewRateLimiter(rdb *redis.Client, config *SlidingWindowConfig) *RateLimiter {
	return &RateLimiter{
		config:    config,
		rdb:       rdb,
		extractor: &defaultExtractor{},
	}
}

// RateLimitResult represents the result of a rate limit check.
type RateLimitResult struct {
	Allowed    bool
	Remaining  int
	ResetAfter time.Duration
	RetryAfter time.Duration
}

// Allow checks if a request is allowed based on the sliding window rate limit.
func (rl *RateLimiter) Allow(ctx context.Context, fingerprint string) (*RateLimitResult, error) {
	now := time.Now()
	windowStart := now.Add(-rl.config.WindowSize)
	key := fmt.Sprintf("%s:%s", rl.config.KeyPrefix, fingerprint)

	pipe := rl.rdb.Pipeline()

	// Remove old entries outside the window.
	pipe.ZRemRangeByScore(ctx, key, "0", fmt.Sprintf("%d", windowStart.UnixNano()))

	// Count requests in the current window.
	countCmd := pipe.ZCard(ctx, key)

	// Add current request.
	pipe.ZAdd(ctx, key, redis.Z{
		Score:  float64(now.UnixNano()),
		Member: fmt.Sprintf("%d:%s", now.UnixNano(), randString(8)),
	})

	// Set TTL on the key to prevent memory leaks.
	pipe.Expire(ctx, key, int64(rl.config.WindowSize*2))

	_, err := pipe.Exec(ctx)
	if err != nil {
		return nil, fmt.Errorf("ratelimit: pipeline exec: %w", err)
	}

	count := countCmd.Val()
	burstLimit := int(float64(rl.config.MaxRequests) * rl.config.BurstMultiplier)

	if count > int64(burstLimit) {
		return &RateLimitResult{
			Allowed:    false,
			Remaining:  0,
			ResetAfter: rl.config.WindowSize,
			RetryAfter: time.Duration(float64(rl.config.WindowSize) / float64(rl.config.MaxRequests)),
		}, nil
	}

	remaining := burstLimit - int(count)
	return &RateLimitResult{
		Allowed:   true,
		Remaining: remaining,
	}, nil
}

// Middleware returns an HTTP middleware for rate limiting.
func (rl *RateLimiter) Middleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		fingerprint := rl.extractor.Extract(r)
		result, err := rl.Allow(r.Context(), fingerprint)
		if err != nil {
			// On Redis error, allow the request but log the error.
			// Fail open is safer than fail closed for flash sale.
			next.ServeHTTP(w, r)
			return
		}

		w.Header().Set("X-RateLimit-Limit", fmt.Sprintf("%d", rl.config.MaxRequests))
		w.Header().Set("X-RateLimit-Remaining", fmt.Sprintf("%d", result.Remaining))
		w.Header().Set("X-RateLimit-Reset", fmt.Sprintf("%d", result.ResetAfter.Milliseconds()))

		if !result.Allowed {
			w.Header().Set("Retry-After", fmt.Sprintf("%.0f", result.RetryAfter.Seconds()))
			w.Header().Set("X-RateLimit-Reset", fmt.Sprintf("%d", result.ResetAfter.Milliseconds()))
			http.Error(w, `{"error":"rate_limit_exceeded","retry_after":`+fmt.Sprintf("%.0f", result.RetryAfter.Seconds())+`}`, http.StatusTooManyRequests)
			return
		}

		next.ServeHTTP(w, r)
	})
}

func randString(n int) string {
	const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
	b := make([]byte, n)
	for i := range b {
		b[i] = letters[time.Now().UnixNano()%int64(len(letters))]
		time.Sleep(1)
	}
	return string(b)
}

package antibot

import (
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"strings"
	"time"
)

// AttestationConfig holds configuration for device attestation.
type AttestationConfig struct {
	// SecretKey used to sign and verify attestation tokens.
	SecretKey []byte
	// TokenExpiry is how long an attestation token is valid.
	TokenExpiry time.Duration
	// MaxClockSkew is the maximum allowed clock skew between client and server.
	MaxClockSkew time.Duration
	// RequiredCAPTCHAScore is the minimum CAPTCHA score required (0.0 - 1.0).
	RequiredCAPTCHAScore float64
}

// DefaultAttestationConfig returns sensible defaults.
func DefaultAttestationConfig(secret []byte) *AttestationConfig {
	if len(secret) == 0 {
		secret = []byte("change-me-in-production")
	}
	return &AttestationConfig{
		SecretKey:            secret,
		TokenExpiry:          5 * time.Minute,
		MaxClockSkew:         30 * time.Second,
		RequiredCAPTCHAScore: 0.5,
	}
}

// AttestationPayload is the data collected from the client-side attestation.
type AttestationPayload struct {
	// WebGL fingerprint (renderer, vendor).
	WebGLRenderer string `json:"webgl_renderer"`
	WebGLVendor   string `json:"webgl_vendor"`
	// Canvas fingerprint.
	CanvasFingerprint string `json:"canvas_fp"`
	// Audio context fingerprint.
	AudioFingerprint string `json:"audio_fp"`
	// Navigator properties.
	HasWebDriver    bool   `json:"has_webdriver"`
	HasChromeRuntime bool  `json:"has_chrome_runtime"`
	PluginsLength   int    `json:"plugins_length"`
	Languages       string `json:"languages"`
	// Timing.
	Timestamp int64 `json:"ts"`
	Nonce     string `json:"nonce"`
	// CAPTCHA score (0.0 - 1.0).
	CAPTCHAScore float64 `json:"captcha_score"`
	// Time taken to solve the attestation (ms).
	SolveTimeMs int `json:"solve_time_ms"`
}

// AttestationToken is the signed token returned to the client.
type AttestationToken struct {
	DeviceFP  string `json:"device_fp"`
	ExpiresAt int64  `json:"expires_at"`
	Signature string `json:"signature"`
}

// AttestationVerifier verifies device attestation payloads.
type AttestationVerifier struct {
	config *AttestationConfig
}

// NewAttestationVerifier creates a new AttestationVerifier.
func NewAttestationVerifier(config *AttestationConfig) *AttestationVerifier {
	return &AttestationVerifier{config: config}
}

// Verify checks whether an attestation payload passes all checks.
func (v *AttestationVerifier) Verify(payload *AttestationPayload) error {
	now := time.Now()

	// 1. Check timestamp freshness.
	ts := time.Unix(payload.Timestamp, 0)
	diff := now.Sub(ts)
	if diff < -v.config.MaxClockSkew || diff > v.config.MaxClockSkew {
		return fmt.Errorf("attestation: clock skew exceeded: %v", diff)
	}

	// 2. Check CAPTCHA score.
	if payload.CAPTCHAScore < v.config.RequiredCAPTCHAScore {
		return fmt.Errorf("attestation: captcha score too low: %.2f", payload.CAPTCHAScore)
	}

	// 3. Check solve time (bots solve too fast or too slow).
	if payload.SolveTimeMs < 500 || payload.SolveTimeMs > 30000 {
		return fmt.Errorf("attestation: solve time suspicious: %dms", payload.SolveTimeMs)
	}

	// 4. Headless browser detection.
	if payload.HasWebDriver {
		return fmt.Errorf("attestation: webdriver detected")
	}
	if payload.PluginsLength == 0 {
		return fmt.Errorf("attestation: no plugins (headless browser)")
	}

	// 5. WebGL fingerprint check (headless browsers have different renderers).
	if strings.Contains(payload.WebGLRenderer, "SwiftShader") ||
		strings.Contains(payload.WebGLRenderer, "llvmpipe") ||
		strings.Contains(payload.WebGLRenderer, "Mock") {
		return fmt.Errorf("attestation: webgl renderer suspicious: %s", payload.WebGLRenderer)
	}

	return nil
}

// GenerateToken creates a signed attestation token for a device fingerprint.
func (v *AttestationVerifier) GenerateToken(deviceFP string) (*AttestationToken, error) {
	expiresAt := time.Now().Add(v.config.TokenExpiry).Unix()

	data := fmt.Sprintf("%s:%d", deviceFP, expiresAt)
	mac := hmac.New(sha256.New, v.config.SecretKey)
	mac.Write([]byte(data))
	sig := base64.URLEncoding.EncodeToString(mac.Sum(nil))

	return &AttestationToken{
		DeviceFP:  deviceFP,
		ExpiresAt: expiresAt,
		Signature: sig,
	}, nil
}

// VerifyToken checks whether an attestation token is valid.
func (v *AttestationVerifier) VerifyToken(tokenStr string) (string, error) {
	var token AttestationToken
	data, err := base64.URLEncoding.DecodeString(tokenStr)
	if err != nil {
		return "", fmt.Errorf("attestation: decode token: %w", err)
	}

	if err := json.Unmarshal(data, &token); err != nil {
		return "", fmt.Errorf("attestation: unmarshal token: %w", err)
	}

	// Check expiry.
	if time.Now().Unix() > token.ExpiresAt {
		return "", fmt.Errorf("attestation: token expired")
	}

	// Verify signature.
	dataToVerify := fmt.Sprintf("%s:%d", token.DeviceFP, token.ExpiresAt)
	mac := hmac.New(sha256.New, v.config.SecretKey)
	mac.Write([]byte(dataToVerify))
	expectedSig := base64.URLEncoding.EncodeToString(mac.Sum(nil))

	if !hmac.Equal([]byte(token.Signature), []byte(expectedSig)) {
		return "", fmt.Errorf("attestation: invalid signature")
	}

	return token.DeviceFP, nil
}

// AttestationMiddleware returns HTTP middleware that verifies attestation tokens.
func (v *AttestationVerifier) AttestationMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		token := r.Header.Get("X-Attestation-Token")
		if token == "" {
			http.Error(w, `{"error":"attestation_required"}`, http.StatusUnauthorized)
			return
		}

		deviceFP, err := v.VerifyToken(token)
		if err != nil {
			http.Error(w, `{"error":"invalid_attestation","detail":"`+err.Error()+`"}`, http.StatusForbidden)
			return
		}

		// Attach verified device fingerprint to context.
		ctx := context.WithValue(r.Context(), ctxKeyDeviceFP{}, deviceFP)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

type ctxKeyDeviceFP struct{}

// GetDeviceFP extracts the verified device fingerprint from context.
func GetDeviceFP(ctx context.Context) string {
	fp, _ := ctx.Value(ctxKeyDeviceFP{}).(string)
	return fp
}

package cache

import (
	"context"
	"fmt"
	"net/http"
	"sync"
	"time"
)

// CacheConfig holds configuration for the stale-while-revalidate cache.
type CacheConfig struct {
	// StaleTTL is how long the cache is fresh (e.g., 30 seconds).
	StaleTTL time.Duration
	// StaleWhileRevalidateTTL is how long the cache can serve stale content
	// while revalidating in the background (e.g., 5 minutes).
	StaleWhileRevalidateTTL time.Duration
	// StaleIfErrorTTL is how long to serve stale content if origin returns error.
	StaleIfErrorTTL time.Duration
}

// DefaultCacheConfig returns sensible defaults for flash sale landing pages.
func DefaultCacheConfig() *CacheConfig {
	return &CacheConfig{
		StaleTTL:                30 * time.Second,
		StaleWhileRevalidateTTL: 5 * time.Minute,
		StaleIfErrorTTL:         1 * time.Hour,
	}
}

// CacheHeadersWriter wraps an http.ResponseWriter to capture the status code.
type CacheHeadersWriter struct {
	http.ResponseWriter
	statusCode int
}

func (w *CacheHeadersWriter) WriteHeader(code int) {
	w.statusCode = code
	w.ResponseWriter.WriteHeader(code)
}

// CacheMiddleware sets CDN-friendly cache headers.
func CacheMiddleware(config *CacheConfig) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			// Only cache GET requests.
			if r.Method != http.MethodGet {
				next.ServeHTTP(w, r)
				return
			}

			writer := &CacheHeadersWriter{ResponseWriter: w, statusCode: http.StatusOK}
			next.ServeHTTP(writer, r)

			// Only cache successful responses.
			if writer.statusCode >= 200 && writer.statusCode < 400 {
				w.Header().Set("Cache-Control", fmt.Sprintf(
					"public, max-age=%.0f, stale-while-revalidate=%.0f, stale-if-error=%.0f",
					config.StaleTTL.Seconds(),
					config.StaleWhileRevalidateTTL.Seconds(),
					config.StaleIfErrorTTL.Seconds(),
				))
				w.Header().Set("Surrogate-Control", fmt.Sprintf(
					"max-age=%.0f, stale-while-revalidate=%.0f",
					config.StaleTTL.Seconds(),
					config.StaleWhileRevalidateTTL.Seconds(),
				))
				w.Header().Set("CDN-Cache-Control", fmt.Sprintf(
					"max-age=%.0f",
					config.StaleTTL.Seconds(),
				))
			}
		})
	}
}

package flashsale

import (
	"context"
	"encoding/json"
	"fmt"
	"log/slog"
	"time"

	"github.com/redis/go-redis/v9"
	"github.com/segmentio/kafka-go"
)

// FlashSaleService orchestrates the flash sale lifecycle.
type FlashSaleService struct {
	stockMgr     *StockPartitionManager
	waitingRoom  *WaitingRoom
	rateLimiter  *RateLimiter
	attestation  *AttestationVerifier
	kafkaWriter  *kafka.Writer
	orderService OrderServiceClient
	logger       *slog.Logger
}

// OrderServiceClient is the interface for communicating with the order service.
type OrderServiceClient interface {
	CreateOrder(ctx context.Context, req *CreateOrderRequest) (*CreateOrderResponse, error)
}

// CreateOrderRequest represents an order creation request.
type CreateOrderRequest struct {
	UserID      string `json:"user_id"`
	ProductID   string `json:"product_id"`
	HubID       string `json:"hub_id"`
	Quantity    int    `json:"quantity"`
	DeviceFP    string `json:"device_fp"`
	Attestation string `json:"attestation"`
}

// CreateOrderResponse represents an order creation response.
type CreateOrderResponse struct {
	OrderID string `json:"order_id"`
	Status  string `json:"status"`
}

// NewFlashSaleService creates a new FlashSaleService.
func NewFlashSaleService(
	stockMgr *StockPartitionManager,
	waitingRoom *WaitingRoom,
	rateLimiter *RateLimiter,
	attestation *AttestationVerifier,
	kafkaWriter *kafka.Writer,
	orderService OrderServiceClient,
	logger *slog.Logger,
) *FlashSaleService {
	return &FlashSaleService{
		stockMgr:     stockMgr,
		waitingRoom:  waitingRoom,
		rateLimiter:  rateLimiter,
		attestation:  attestation,
		kafkaWriter:  kafkaWriter,
		orderService: orderService,
		logger:       logger,
	}
}

// Checkout handles the full flash sale checkout flow.
func (s *FlashSaleService) Checkout(ctx context.Context, req *CreateOrderRequest) (map[string]interface{}, error) {
	// Step 1: Verify attestation.
	deviceFP, err := s.attestation.VerifyToken(req.Attestation)
	if err != nil {
		return nil, fmt.Errorf("flashsale: attestation failed: %w", err)
	}

	// Step 2: Rate limit check.
	rlResult, err := s.rateLimiter.Allow(ctx, deviceFP)
	if err != nil {
		return nil, fmt.Errorf("flashsale: rate limit check failed: %w", err)
	}
	if !rlResult.Allowed {
		return map[string]interface{}{
			"status":       "rate_limited",
			"retry_after":  rlResult.RetryAfter.Seconds(),
			"remaining":    0,
		}, nil
	}

	// Step 3: Waiting room admission.
	status, err := s.waitingRoom.Enqueue(ctx, req.UserID, deviceFP)
	if err != nil {
		return nil, fmt.Errorf("flashsale: waiting room: %w", err)
	}
	if status.Status != "admitted" {
		return map[string]interface{}{
			"status":       "waiting",
			"position":     status.Position,
			"wait_time_seconds": status.WaitTimeSec,
		}, nil
	}

	// Step 4: Reserve stock atomically.
	bucketResult, err := s.stockMgr.ReserveStock(ctx, deviceFP, req.Quantity)
	if err != nil {
		return nil, fmt.Errorf("flashsale: stock reserve: %w", err)
	}
	if !bucketResult.Success {
		return map[string]interface{}{
			"status": "out_of_stock",
		}, nil
	}

	// Step 5: Publish order event to Kafka.
	orderEvent := map[string]interface{}{
		"user_id":    req.UserID,
		"product_id": req.ProductID,
		"hub_id":     req.HubID,
		"quantity":   req.Quantity,
		"device_fp":  deviceFP,
		"bucket":     bucketResult.BucketIndex,
		"timestamp":  time.Now().Unix(),
		"event_type": "order.created",
	}

	eventBytes, err := json.Marshal(orderEvent)
	if err != nil {
		return nil, fmt.Errorf("flashsale: marshal event: %w", err)
	}

	err = s.kafkaWriter.WriteMessages(ctx, kafka.Message{
		Key:   []byte(req.OrderID),
		Value: eventBytes,
		Headers: []kafka.Header{
			{Key: "event_type", Value: []byte("order.created")},
			{Key: "priority", Value: []byte("high")},
		},
	})
	if err != nil {
		return nil, fmt.Errorf("flashsale: publish event: %w", err)
	}

	s.logger.InfoContext(ctx, "flash sale checkout successful",
		"user_id", req.UserID,
		"product_id", req.ProductID,
		"bucket", bucketResult.BucketIndex,
		"order_id", req.OrderID,
	)

	return map[string]interface{}{
		"status":   "success",
		"order_id": req.OrderID,
	}, nil
}

// FlashSaleServer is the HTTP handler for flash sale endpoints.
type FlashSaleServer struct {
	service *FlashSaleService
}

// NewFlashSaleServer creates a new HTTP handler.
func NewFlashSaleServer(service *FlashSaleService) *FlashSaleServer {
	return &FlashSaleServer{service: service}
}

// HandleCheckout handles the POST /flash-sale/checkout endpoint.
func (s *FlashSaleServer) HandleCheckout(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, `{"error":"method_not_allowed"}`, http.StatusMethodNotAllowed)
		return
	}

	var req CreateOrderRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, `{"error":"invalid_request"}`, http.StatusBadRequest)
		return
	}

	result, err := s.service.Checkout(r.Context(), &req)
	if err != nil {
		s.service.logger.ErrorContext(r.Context(), "checkout failed", "error", err)
		http.Error(w, `{"error":"internal_error"}`, http.StatusInternalServerError)
		return
	}

	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(result)
}

// repository/redis.go
func (r *FlashSaleRepo) CheckIdempotency(ctx context.Context, idemKey string) (bool, string, error) {
    key := r.idempotencyKey(idemKey)
    ok, err := r.rdb.SetNX(ctx, key, "locked", 30*time.Second).Result()
    if !ok {
        result, _ := r.rdb.Get(ctx, key+":result").Result()
        return true, result, nil // Conflict — return cached result
    }
    return false, "", nil
}

HTTP 409 Conflict
{"status": "idempotency_conflict", "order_id": "ORD-previous-result"}

States: RESERVED → CONFIRMED (checkout success)
                    → RELEASED (checkout cancelled)
                    → EXPIRED   (TTL elapsed, auto-reaper)

flash:reservation:RES-abc123
  id: RES-abc123
  product_id: flash-indomie-2026
  user_id: user-xyz
  quantity: 2
  bucket_idx: 3
  status: reserved
  created_at: 1719000000000
  expires_at: 1719000300000

-- Check status is "reserved" or "expired"
-- If "released" or "confirmed" → idempotent, return success
-- INCRBY bucket key by quantity
-- INCRBY total key by quantity
-- Set status to "released"

func (s *FlashSaleService) StartBackgroundJobs(ctx context.Context, productID string) {
    go func() {
        ticker := time.NewTicker(model.ReaperInterval) // 10s
        for {
            select {
            case <-ctx.Done(): return
            case <-ticker.C:
                n, _ := s.repo.RunReaper(ctx, productID, model.ReaperGracePeriod) // 15s grace
            }
        }
    }()
}

GET /flash-sale/queue-stream?product_id=X&user_id=Y
→ text/event-stream
→ data: {"position": 42, "status": "queued"}
→ data: {"position": 15, "status": "queued"}
→ data: {"position": 0, "status": "admitted"}

Admission Consumer → Redis Pub/Sub (flash:queue:{productID}:{userID})
                  → SSE Handler → Client (push, no polling)

func (r *FlashSaleRepo) CleanWaitingRoom(ctx context.Context, productID string, ttl time.Duration) (int, error) {
    cutoff := float64(time.Now().Add(-ttl).UnixNano())
    return r.rdb.ZRemRangeByScore(ctx, key, "0", strconv.FormatFloat(cutoff, 'f', 0, 64)).Result()
}

go func() {
    ticker := time.NewTicker(model.AdmissionInterval) // 500ms
    for {
        select {
        case <-ctx.Done(): return
        case <-ticker.C:
            users, _ := s.repo.AdmitNext(ctx, productID, model.AdmissionBatchSize)
            for _, userID := range users {
                s.repo.PublishQueueEvent(ctx, productID, userID, model.QueueEvent{
                    Position: 0, Status: "admitted",
                })
            }
        }
    }
}()

r.GET("/flash-sale/token", middleware.CDNCache(middleware.DefaultCacheConfig()), h.Token)

Cache-Control: public, max-age=30, stale-while-revalidate=300, stale-if-error=3600
Surrogate-Control: max-age=30, stale-while-revalidate=300
CDN-Cache-Control: max-age=30

type OrderCreatedEvent struct {
    OrderID       string `json:"order_id"`
    UserID        string `json:"user_id"`
    ProductID     string `json:"product_id"`
    Quantity      int    `json:"quantity"`
    ReservationID string `json:"reservation_id"`
    DeviceFP      string `json:"device_fp"`
    Timestamp     int64  `json:"timestamp"`
    EventType     string `json:"event_type"`
}

func (h *FlashSaleHandler) Token(c *gin.Context) {
    mac := hmac.New(sha256.New, h.hmacSecret)
    payload := fmt.Sprintf("%s:%d", deviceFP, time.Now().Unix()+30)
    mac.Write([]byte(payload))
    token := hex.EncodeToString(mac.Sum(nil))
    kit.OK(c, gin.H{"token": token, "expires_in": 30})
}

PORT_FLASH_SALE=8102
REDIS_ADDR=localhost:6379
HMAC_SECRET=dev-secret-do-not-use-in-production