import {
  IP_BAN_TTL_SECONDS,
  IP_RATE_LIMIT,
  IP_RATE_WINDOW_SECONDS,
} from "@/lib/constants/cache";
import { withBoundedRedis } from "@/lib/redis";
import { writeAlert } from "@/modules/alert/service";

export type IpRateLimitResult =
  | { allowed: true }
  | { allowed: false; errorCode: "RATE_LIMITED"; banned: boolean };

function ipRateKey(ip: string): string {
  return `ratelimit:ip:${ip}`;
}

function ipBanKey(ip: string): string {
  return `ban:ip:${ip}`;
}

/** IP 级限流：1000 次/分钟，超限封禁 10 分钟 */
export async function checkIpRateLimit(
  ip: string,
): Promise<IpRateLimitResult> {
  const result = await withBoundedRedis(async (redis) => {
    const banned = await redis.exists(ipBanKey(ip));
    if (banned === 1) {
      return { allowed: false as const, errorCode: "RATE_LIMITED" as const, banned: true };
    }

    const key = ipRateKey(ip);
    const count = await redis.incr(key);

    if (count === 1) {
      await redis.expire(key, IP_RATE_WINDOW_SECONDS);
    }

    if (count > IP_RATE_LIMIT) {
      await redis.set(ipBanKey(ip), "1", "EX", IP_BAN_TTL_SECONDS);
      void writeAlert("SECURITY", {
        detail: {
          reason: "ip_rate_limit_ban",
          ip,
          count,
          window_seconds: IP_RATE_WINDOW_SECONDS,
        },
      });
      return { allowed: false as const, errorCode: "RATE_LIMITED" as const, banned: true };
    }

    return { allowed: true as const };
  });

  if (!result) {
    return { allowed: true };
  }
  return result;
}