# 📁 main.py
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
import base64, os, json
from typing import Dict
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.exceptions import InvalidSignature

app = FastAPI()

# دیتابیس ساده در حافظه (برای مثال)
USERS_DB: Dict[str, dict] = {}

# مدل‌ها
class ChallengeRequest(BaseModel):
    username: str

class CredentialRegister(BaseModel):
    username: str
    public_key: str  # Base64 encoded
    credential_id: str

class AuthRequest(BaseModel):
    username: str
    credential_id: str
    signature: str   # Base64 encoded
    challenge: str

# ✅ مرحله ۱: ایجاد Challenge برای ثبت (Registration)
@app.post("/api/biometric/challenge")
def create_challenge(req: ChallengeRequest):
    challenge = os.urandom(32)
    encoded = base64.b64encode(challenge).decode()
    USERS_DB[req.username] = {"challenge": encoded}
    return {"challenge": encoded}

# ✅ مرحله ۲: ذخیره Public Key (بعد از ساخت Credential در مرورگر)
@app.post("/api/biometric/register")
def register_credential(data: CredentialRegister):
    USERS_DB[data.username]["public_key"] = data.public_key
    USERS_DB[data.username]["credential_id"] = data.credential_id
    return {"success": True, "message": "Public key saved."}

# ✅ مرحله ۳: تأیید ورود (Authentication)
@app.post("/api/biometric/verify")
def verify_signature(data: AuthRequest):
    user = USERS_DB.get(data.username)
    if not user:
        raise HTTPException(status_code=404, detail="User not found")

    # بارگذاری کلید عمومی از Base64
    public_key_bytes = base64.b64decode(user["public_key"])
    public_key = serialization.load_pem_public_key(public_key_bytes)

    # تبدیل challenge و امضا از Base64
    challenge = base64.b64decode(data.challenge)
    signature = base64.b64decode(data.signature)

    # ✅ بررسی امضا
    try:
        public_key.verify(signature, challenge, ec.ECDSA(hashes.SHA256()))
        return {"success": True, "message": "Authentication successful"}
    except InvalidSignature:
        raise HTTPException(status_code=401, detail="Invalid signature")

// 📁 src/hooks/useWebAuthn.ts
'use client'
import { useState } from 'react'

export const useWebAuthn = () => {
  const [isLoading, setIsLoading] = useState(false)

  // ✅ ثبت (Registration)
  const register = async (username: string) => {
    setIsLoading(true)
    try {
      // مرحله ۱: دریافت Challenge از سرور
      const challengeResp = await fetch('/api/biometric/challenge', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ username }),
      })
      const { challenge } = await challengeResp.json()

      // مرحله ۲: ایجاد Credential جدید
      const publicKey: PublicKeyCredentialCreationOptions = {
        challenge: Uint8Array.from(atob(challenge), (c) => c.charCodeAt(0)),
        rp: { name: 'MyApp', id: window.location.hostname },
        user: {
          id: new TextEncoder().encode(username),
          name: username,
          displayName: username,
        },
        pubKeyCredParams: [{ type: 'public-key', alg: -7 }], // ES256
      }

      const credential = await navigator.credentials.create({ publicKey })

      // مرحله ۳: ارسال Public Key به سرور
      const attestation = credential as PublicKeyCredential
      const publicKeyData = btoa(String.fromCharCode(...new Uint8Array(attestation.rawId)))

      await fetch('/api/biometric/register', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          username,
          credential_id: attestation.id,
          public_key: publicKeyData,
        }),
      })
    } finally {
      setIsLoading(false)
    }
  }

  // ✅ ورود (Authentication)
  const authenticate = async (username: string) => {
    setIsLoading(true)
    try {
      // مرحله ۱: گرفتن Challenge جدید از سرور
      const res = await fetch('/api/biometric/challenge', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ username }),
      })
      const { challenge } = await res.json()

      // مرحله ۲: درخواست امضا از دستگاه کاربر
      const assertion = await navigator.credentials.get({
        publicKey: {
          challenge: Uint8Array.from(atob(challenge), (c) => c.charCodeAt(0)),
          userVerification: 'required',
        },
      })

      // مرحله ۳: ارسال امضا به سرور
      const signature = btoa(
        String.fromCharCode(
          ...new Uint8Array((assertion as PublicKeyCredential).response.signature)
        )
      )

      await fetch('/api/biometric/verify', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          username,
          credential_id: (assertion as PublicKeyCredential).id,
          signature,
          challenge,
        }),
      })
    } finally {
      setIsLoading(false)
    }
  }

  return { register, authenticate, isLoading }
}