import { Op } from "sequelize";
import { initDb } from "@/lib/db";

/**
 * Post-commit anomaly checks. Never blocks casting — flags only for review.
 */
export async function runPostCastAnomalyChecks(input: {
  electionId: string;
  voterRollId: string;
  ipHash: string | null;
  deviceFingerprintHash: string | null;
}): Promise<void> {
  const { BallotCastEvent, ElectionSecurityEvent } = initDb();

  if (input.deviceFingerprintHash) {
    const deviceReuse = await BallotCastEvent.count({
      where: {
        electionId: input.electionId,
        deviceFingerprintHash: input.deviceFingerprintHash,
        voterRollId: { [Op.ne]: input.voterRollId },
      },
    });
    if (deviceReuse > 0) {
      await ElectionSecurityEvent.create({
        electionId: input.electionId,
        voterRollId: input.voterRollId,
        eventType: "device_reuse_flag",
        ipHash: input.ipHash,
        deviceFingerprintHash: input.deviceFingerprintHash,
        detail: {
          otherCastsWithSameDevice: deviceReuse,
        },
        reviewStatus: "open",
      });
    }
  }

  if (input.ipHash) {
    const ipCluster = await BallotCastEvent.count({
      where: {
        electionId: input.electionId,
        ipHash: input.ipHash,
        voterRollId: { [Op.ne]: input.voterRollId },
      },
    });
    if (ipCluster >= 3) {
      await ElectionSecurityEvent.create({
        electionId: input.electionId,
        voterRollId: input.voterRollId,
        eventType: "ai_anomaly_flag",
        ipHash: input.ipHash,
        deviceFingerprintHash: input.deviceFingerprintHash,
        detail: {
          reason: "ip_cluster",
          otherCastsWithSameIp: ipCluster,
        },
        reviewStatus: "open",
      });
    }
  }
}

export async function flagDuplicateAttempt(input: {
  electionId: string;
  voterRollId: string;
  ipHash: string | null;
  deviceFingerprintHash: string | null;
}): Promise<void> {
  const { ElectionSecurityEvent } = initDb();
  await ElectionSecurityEvent.create({
    electionId: input.electionId,
    voterRollId: input.voterRollId,
    eventType: "duplicate_attempt",
    ipHash: input.ipHash,
    deviceFingerprintHash: input.deviceFingerprintHash,
    detail: { source: "castBallot" },
    reviewStatus: "open",
  });
}