"""Password hashing and validation service.

⚠️ AUTO-GENERATED BY PRISM - DO NOT EDIT
Handles secure password hashing with bcrypt and policy validation.
"""

from __future__ import annotations

import re

from passlib.context import CryptContext


class PasswordService:
    """Handles password hashing and validation."""

    def __init__(self):
        """Initialize password service with bcrypt."""
        self.pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

        # Password policy from configuration
        self.min_length = {{ min_length }}
        self.require_uppercase = {{ require_uppercase }}
        self.require_lowercase = {{ require_lowercase }}
        self.require_number = {{ require_number }}
        self.require_special = {{ require_special }}

    def hash_password(self, password: str) -> str:
        """Hash a password using bcrypt.

        Args:
            password: Plain text password

        Returns:
            Bcrypt hash of the password
        """
        return self.pwd_context.hash(password)

    def verify_password(self, plain_password: str, hashed_password: str) -> bool:
        """Verify a password against a hash.

        Uses constant-time comparison to prevent timing attacks.

        Args:
            plain_password: Plain text password to verify
            hashed_password: Bcrypt hash to verify against

        Returns:
            True if password matches hash, False otherwise
        """
        return self.pwd_context.verify(plain_password, hashed_password)

    def validate_password_strength(self, password: str) -> tuple[bool, list[str]]:
        """Validate password meets policy requirements.

        Args:
            password: Password to validate

        Returns:
            Tuple of (is_valid, list_of_error_messages)
        """
        errors = []

        if len(password) < self.min_length:
            errors.append(f"Password must be at least {self.min_length} characters")

        if self.require_uppercase and not re.search(r"[A-Z]", password):
            errors.append("Password must contain at least one uppercase letter")

        if self.require_lowercase and not re.search(r"[a-z]", password):
            errors.append("Password must contain at least one lowercase letter")

        if self.require_number and not re.search(r"\d", password):
            errors.append("Password must contain at least one number")

        if self.require_special and not re.search(r'[!@#$%^&*(),.?":{}|<>]', password):
            errors.append("Password must contain at least one special character")

        return (len(errors) == 0, errors)


# Singleton instance
password_service = PasswordService()
