// rate-limiter.js — generated by Claude
import Redis from 'ioredis';

const redis = new Redis(process.env.REDIS_URL);

/**
 * Sliding window rate limiter using Redis sorted sets.
 * More accurate than fixed window — no boundary burst exploitation.
 */
export async function slidingWindowRateLimit(
  key: string,
  limit: number,
  windowMs: number
): Promise<{ allowed: boolean; remaining: number; resetAt: number }> {
  const now = Date.now();
  const windowStart = now - windowMs;

  // Lua script for atomic operation (count + add + expire in one round trip)
  const luaScript = `
    local key = KEYS[1]
    local now = tonumber(ARGV[1])
    local window_start = tonumber(ARGV[2])
    local limit = tonumber(ARGV[3])
    local window_ms = tonumber(ARGV[4])

    -- Remove expired entries
    redis.call('ZREMRANGEBYSCORE', key, 0, window_start)

    -- Count current requests in window
    local count = redis.call('ZCARD', key)

    if count < limit then
      -- Add current request
      redis.call('ZADD', key, now, now .. ':' .. math.random(1000000))
      redis.call('PEXPIRE', key, window_ms)
      return {1, limit - count - 1, now + window_ms}
    else
      -- Get oldest entry to calculate reset time
      local oldest = redis.call('ZRANGE', key, 0, 0, 'WITHSCORES')
      local reset_at = tonumber(oldest[2]) + window_ms
      return {0, 0, reset_at}
    end
  `;

  const result = await redis.eval(
    luaScript,
    1,
    `rate_limit:${key}`,
    now.toString(),
    windowStart.toString(),
    limit.toString(),
    windowMs.toString(),
  ) as [number, number, number];

  return {
    allowed: result[0] === 1,
    remaining: result[1],
    resetAt: result[2],
  };
}

// Express middleware factory
export function createRateLimiter(options: {
  limit: number;
  windowMs: number;
  keyGenerator?: (req: any) => string;
  skipSuccessfulRequests?: boolean;
}) {
  const { limit, windowMs, keyGenerator, skipSuccessfulRequests = false } = options;

  return async (req: any, res: any, next: any) => {
    const key = keyGenerator
      ? keyGenerator(req)
      : req.user?.id ?? req.ip;

    const { allowed, remaining, resetAt } = await slidingWindowRateLimit(
      key, limit, windowMs
    );

    // Set rate limit headers (RFC 6585 + draft-ietf-httpapi-ratelimit-headers)
    res.set({
      'X-RateLimit-Limit': limit.toString(),
      'X-RateLimit-Remaining': remaining.toString(),
      'X-RateLimit-Reset': Math.ceil(resetAt / 1000).toString(),
      'RateLimit-Limit': `${limit};w=${windowMs / 1000}`,
    });

    if (!allowed) {
      res.set('Retry-After', Math.ceil((resetAt - Date.now()) / 1000).toString());
      return res.status(429).json({
        error: 'rate_limit_exceeded',
        message: `Rate limit exceeded. Try again in ${Math.ceil((resetAt - Date.now()) / 1000)} seconds.`,
        retryAfter: Math.ceil((resetAt - Date.now()) / 1000),
      });
    }

    if (skipSuccessfulRequests) {
      res.on('finish', () => {
        if (res.statusCode < 400) {
          // Remove this request from the count on success
          redis.zrem(`rate_limit:${key}`, `${Date.now()}`);
        }
      });
    }

    next();
  };
}

// Usage
const authLimiter = createRateLimiter({
  limit: 10,
  windowMs: 60 * 1000,  // 10 per minute
  keyGenerator: (req) => `auth:${req.ip}`,
});

const apiLimiter = createRateLimiter({
  limit: 1000,
  windowMs: 60 * 60 * 1000,  // 1000 per hour
  keyGenerator: (req) => `api:${req.user?.id ?? req.ip}`,
});

app.use('/api/login', authLimiter);
app.use('/api/', apiLimiter);