import { Blursec } from "@blursec/sdk";

const tracingFetch: typeof fetch = async (input, init) => {
  const url = typeof input === "string" ? input : input.toString();
  const start = performance.now();
  try {
    const response = await fetch(input, init);
    metrics.histogram("blursec.fetch.ms", performance.now() - start, {
      status: response.status,
      url: stripQuery(url),
    });
    return response;
  } catch (err) {
    metrics.increment("blursec.fetch.error");
    throw err;
  }
};

const blursec = new Blursec({
  apiKey: process.env.BLURSEC_API_KEY!,
  fetch: tracingFetch,
});

// ❌ DO NOT do this
async function checkWithRetry(email: string, password: string) {
  for (let i = 0; i < 3; i++) {
    try {
      return await blursec.credentials.check(email, password, {
        failOpen: false,
        timeoutMs: 1500,
      });
    } catch {
      await sleep(100 * 2 ** i);
    }
  }
  // ...what now? you've added 3 seconds of latency for nothing.
}

// ✅ Do this instead
const risk = await blursec.credentials.check(email, password, {
  timeoutMs: 500,   // tight budget, but fails open if blown
});

const retryingFetch: typeof fetch = async (input, init) => {
  const url = typeof input === "string" ? input : input.toString();
  if (url.includes("/credentials/check")) {
    return fetch(input, init); // never retry credential checks
  }

  let lastErr: unknown;
  for (let i = 0; i < 3; i++) {
    try {
      const r = await fetch(input, init);
      if (r.status < 500) return r;
      lastErr = new Error(`status ${r.status}`);
    } catch (err) {
      lastErr = err;
    }
    await new Promise((r) => setTimeout(r, 100 * 2 ** i));
  }
  throw lastErr;
};

const risk = await blursec.checkCredential(email, password);

metrics.histogram("blursec.check.ms", risk.durationMs, {
  failed_open: String(risk.failedOpen),
  leaked: String(risk.leaked),
  severity: risk.severity ?? "none",
});

const controller = new AbortController();
req.on("close", () => controller.abort()); // client disconnected

const risk = await blursec.credentials.check(email, password, {
  signal: controller.signal,
  timeoutMs: 1000,
});

// /admin/login — pin everything stricter
const adminMap = {
  low: "force_reset",
  medium: "block",
  high: "block",
  critical: "block",
} as const;

app.post("/admin/login", async (req, res) => {
  const risk = await blursec.checkCredential(req.body.email, req.body.password, {
    severityActions: adminMap,
  });

  if (risk.recommendedAction !== "allow") {
    return res.status(403).json({ error: "credential_risk", risk });
  }
});

import { hashCredential, matchesHash, HASH_PREFIX_LENGTH } from "@blursec/sdk";

const { full, prefix } = await hashCredential(email, password);
// → prefix is `full.slice(0, HASH_PREFIX_LENGTH)`

const matches = await myTransport.getRange(prefix);
const leaked = matches.some((m) => matchesHash(full, m.hashSuffix));