import { betterAuth } from "better-auth";
import { abuseDetection } from "better-auth-abuse-detection";

const auth = betterAuth({
  plugins: [
    abuseDetection({
      // Detection strategies
      strategies: {
        credentialStuffing: {
          enabled: true,
          threshold: 5, // Failed attempts before flagging
          windowMinutes: 10,
        },
        velocityCheck: {
          enabled: true,
          maxSignIns: 10,
          windowMinutes: 5,
        },
        impossibleTravel: {
          enabled: true,
          speedKmh: 1000, // Max travel speed
        },
        deviceAnomaly: {
          enabled: true,
          requireKnownDevice: false,
        },
        behavioralAnalysis: {
          enabled: true,
          factors: ["typing_pattern", "mouse_movement", "time_patterns"],
        },
      },
      
      // Risk scoring
      riskScoring: {
        enabled: true,
        blockThreshold: 0.9, // Block if risk score > 0.9
        challengeThreshold: 0.7, // Additional verification if > 0.7
        factors: {
          newDevice: 0.2,
          newLocation: 0.3,
          vpnUsage: 0.1,
          failedAttempts: 0.4,
        },
      },
      
      // Actions
      actions: {
        block: {
          duration: 3600, // 1 hour
          message: "Suspicious activity detected",
        },
        challenge: {
          types: ["captcha", "email", "sms"],
        },
        notify: {
          user: true,
          admin: true,
        },
      },
      
      // Machine learning
      ml: {
        enabled: true,
        modelUrl: process.env.ML_MODEL_URL,
        features: ["ip_reputation", "email_age", "device_trust"],
      },
      
      // Events
      onThreatDetected: async (threat) => {
        console.log(`Threat detected: ${threat.type} for user ${threat.userId}`);
        // Send to SIEM or security monitoring
      },
      onAccountCompromised: async (user) => {
        // Lock account and notify user
      },
    }),
  ],
});