import secrets
from datetime import datetime, timedelta, timezone

import bcrypt

from app.core.config import settings


def hash_password(password: str) -> str:
    return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()


def verify_password(password: str, password_hash: str) -> bool:
    return bcrypt.checkpw(password.encode(), password_hash.encode())


def create_session_token() -> str:
    return secrets.token_urlsafe(32)


def session_expires_at() -> str:
    expires = datetime.now(timezone.utc) + timedelta(hours=settings.session_ttl_hours)
    return expires.isoformat()


def is_session_expired(expires_at: str) -> bool:
    expiry = datetime.fromisoformat(expires_at)
    # Ensure timezone-aware comparison
    if expiry.tzinfo is None:
        expiry = expiry.replace(tzinfo=timezone.utc)
    return datetime.now(timezone.utc) > expiry