package authproxy

import (
	"sync"
	"time"
)

// nonceCache makes hand-off tokens single-use. Entries expire alongside the
// token they guard, so the map stays tiny (hand-off tokens live 60 seconds).
type nonceCache struct {
	mu   sync.Mutex
	seen map[string]int64
}

func newNonceCache() *nonceCache {
	return &nonceCache{seen: make(map[string]int64)}
}

// use records the nonce and reports whether this was its first use.
func (c *nonceCache) use(nonce string, exp int64) bool {
	c.mu.Lock()
	defer c.mu.Unlock()
	now := time.Now().Unix()
	for k, v := range c.seen {
		if v < now {
			delete(c.seen, k)
		}
	}
	if _, dup := c.seen[nonce]; dup {
		return false
	}
	c.seen[nonce] = exp
	return true
}