<?php
declare(strict_types=1);
namespace App\Repository\Pdo;

use App\Repository\NonceRepository;
use PDO;

/**
 * `nonces.nonce` is the PRIMARY KEY (see schema.sql). IngestController already
 * calls seen() before remember(), so under normal operation remember() never
 * collides. Under a replay race (two requests with the same nonce arriving
 * concurrently), the PK uniqueness constraint is the real guard: the losing
 * remember() throws a PDOException on the duplicate key instead of silently
 * overwriting -- closing the seen()/remember() TOCTOU flagged in the Task 7
 * review. We deliberately do not catch/swallow that exception here.
 */
final class PdoNonceRepository implements NonceRepository
{
    public function __construct(private PDO $pdo) {}

    public function seen(string $nonce): bool
    {
        $st = $this->pdo->prepare('SELECT 1 FROM nonces WHERE nonce = ? LIMIT 1');
        $st->execute([$nonce]);
        return (bool)$st->fetchColumn();
    }

    public function remember(string $nonce, int $expiresAt): void
    {
        $st = $this->pdo->prepare('INSERT INTO nonces (nonce, expires_at) VALUES (?, ?)');
        $st->execute([$nonce, $expiresAt]);
        // Cron-less reap: Cafe24 has no scheduler, so expired nonces accumulate forever until
        // the table bloats and inserts slow/fail. Opportunistically prune a bounded batch of
        // already-expired rows (safe: seen() only cares about unexpired ones).
        if (mt_rand(1, 100) === 1) {
            $del = $this->pdo->prepare('DELETE FROM nonces WHERE expires_at < ? LIMIT 5000');
            $del->execute([time()]);
        }
    }
}