Ticket Verification

model CheckIn {
  id        String   @id @default(cuid())
  
  checkedInAt DateTime @default(now())
  checkedInBy String? // Staff member who checked in
  location    String? // Check-in location/gate
  
  // POA NFT info
  poaTokenId      Int?
  poaContractAddr String?
  poaTxHash       String?

  // Relations
  ticket   Ticket @relation(fields: [ticketId], references: [id])
  ticketId String @unique
  
  event    Event  @relation(fields: [eventId], references: [id])
  eventId  String
  
  user     User   @relation(fields: [userId], references: [id])
  userId   String

  @@map("check_ins")
}

import crypto from 'crypto'

export const DEFAULT_QR_SECRET_SALT = 'gatepass-secure-qr-salt-2024'

export function generateQr(
  ticketId: string,
  eventId: string,
  secretSalt: string = DEFAULT_QR_SECRET_SALT
): string {
  const timestamp = Date.now()
  const payload = `${ticketId}|${eventId}|${timestamp}`
  
  // Create HMAC signature
  const signature = crypto
    .createHmac('sha256', secretSalt)
    .update(payload)
    .digest('hex')
  
  return `${payload}|${signature}`
}

export interface QrVerificationResult {
  status: 'VALID' | 'ALREADY_USED' | 'FAKE' | 'TOO_EARLY' | 'EXPIRED'
  ticketId: string
  eventId: string
  timestamp: number
}

export async function verifyQr(
  qrString: string,
  secretSalt: string,
  expectedEventId: string,
  isUsed: (ticketId: string) => boolean,
  markUsed: (ticketId: string) => void,
  eventStartTime: number
): Promise<QrVerificationResult> {
  const parts = qrString.split('|')
  
  if (parts.length !== 4) {
    return {
      status: 'FAKE',
      ticketId: '',
      eventId: '',
      timestamp: 0
    }
  }
  
  const [ticketId, eventId, timestampStr, providedSignature] = parts
  const timestamp = parseInt(timestampStr, 10)
  
  // Verify event ID
  if (eventId !== expectedEventId) {
    return { status: 'FAKE', ticketId, eventId, timestamp }
  }
  
  // Recreate signature
  const payload = `${ticketId}|${eventId}|${timestamp}`
  const expectedSignature = crypto
    .createHmac('sha256', secretSalt)
    .update(payload)
    .digest('hex')
  
  // Compare signatures (constant-time comparison)
  if (!crypto.timingSafeEqual(
    Buffer.from(providedSignature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  )) {
    return { status: 'FAKE', ticketId, eventId, timestamp }
  }
  
  // Check if ticket already used
  if (isUsed(ticketId)) {
    return { status: 'ALREADY_USED', ticketId, eventId, timestamp }
  }
  
  // Check timing
  const now = Date.now()
  if (now < eventStartTime) {
    return { status: 'TOO_EARLY', ticketId, eventId, timestamp }
  }
  
  // QR code expiry (24 hours after event start)
  const qrExpiryTime = eventStartTime + (24 * 60 * 60 * 1000)
  if (now > qrExpiryTime) {
    return { status: 'EXPIRED', ticketId, eventId, timestamp }
  }
  
  // Mark as used
  markUsed(ticketId)
  
  return { status: 'VALID', ticketId, eventId, timestamp }
}

export function MobileScanner({ onBack }: MobileScannerProps) {
  const [isScanning, setIsScanning] = useState(false)
  const [scanResults, setScanResults] = useState<ScanResult[]>([])
  const [currentEventId, setCurrentEventId] = useState<string>('1')
  const usedTicketsRef = useRef<Set<string>>(new Set())
  const scannerRef = useRef<Html5QrcodeScanner | null>(null)

  useEffect(() => {
    const containerId = 'qr-reader'
    if (isScanning && !scannerRef.current) {
      const scanner = new Html5QrcodeScanner(
        containerId, 
        { fps: 10, qrbox: 250 }, 
        false
      )
      
      scanner.render(
        async (decodedText) => {
          const parts = decodedText.split('|')
          const eventIdFromQr = parts[1] || currentEventId
          
          const result = await verifyQr(
            decodedText,
            DEFAULT_QR_SECRET_SALT,
            eventIdFromQr,
            (tid) => usedTicketsRef.current.has(tid),
            (tid) => usedTicketsRef.current.add(tid),
            Date.now() - 60 * 60 * 1000
          )
          
          handleVerificationOutcome(decodedText, result)
        },
        (error) => {
          // Ignore scan errors (noisy)
        }
      )
      
      scannerRef.current = scanner
    }
  }, [isScanning, currentEventId])

  const handleVerificationOutcome = (qrString: string, result: any) => {
    const statusMap: Record<string, ScanResult['status']> = {
      VALID: 'valid',
      ALREADY_USED: 'used',
      FAKE: 'invalid',
      TOO_EARLY: 'expired',
      EXPIRED: 'expired'
    }
    const status = statusMap[result.status] ?? 'invalid'

    const newScan: ScanResult = {
      id: Date.now().toString(),
      ticketId: result.ticketId,
      eventTitle: selectedEventTitle,
      attendeeName: 'Unknown',
      ticketType: 'General',
      seatNumber: 'N/A',
      status,
      scanTime: new Date().toLocaleTimeString(),
      walletAddress: '0x0000...0000'
    }

    setScanResults(prev => [newScan, ...prev])

    if (status === 'valid') {
      toast.success('VALID ticket')
    } else if (status === 'used') {
      toast.error('ALREADY USED')
    } else {
      toast.error('FAKE/INVALID ticket')
    }
  }
}