CREATE PROCEDURE [dbo].[AuthenticateUser]
@Identifier varchar(255),
@password_verify_result BIT,
@LastLoginIP varchar(15)
AS
BEGIN
SET NOCOUNT ON;

DECLARE @Result varchar(20)
DECLARE @WindyCode varchar(50)
DECLARE @AuthID varchar(50)
DECLARE @LoginAttempts int
DECLARE @IsLocked BIT
DECLARE @Now datetime = GETDATE()
DECLARE @LastLogin datetime
DECLARE @Token NVARCHAR(64)
DECLARE @RandomBytes VARBINARY(32)

BEGIN TRY
    BEGIN TRANSACTION

    -- Retrieve account information
    SELECT @WindyCode = WindyCode, @LoginAttempts = LoginAttempts, @IsLocked = IsLocked, @LastLogin = LastLogin
    FROM AccountTable 
    WHERE WindyCode = @Identifier OR Email = @Identifier;
		SELECT @AuthID = AuthID
    FROM RustyHearts_Auth.dbo.AuthTable
    WHERE WindyCode = @WindyCode;
		
    -- Check if last login attempt is within 5 minutes
    IF DATEDIFF(minute, @LastLogin, @Now) > 5 
    BEGIN
        UPDATE AccountTable SET LoginAttempts = 0 WHERE WindyCode = @Identifier OR Email = @Identifier;
    END
	    
    -- Verify password
    IF @password_verify_result = 1 
    BEGIN
        SET @Result = 'LoginSuccess';
        
				SET @RandomBytes = CAST(CRYPT_GEN_RANDOM(32) AS VARBINARY(32)) -- Generate 32 random bytes
				SET @Token = LOWER(CONVERT(NVARCHAR(64), HashBytes('SHA2_256', @RandomBytes), 2)) -- Hash the random bytes using SHA256 and convert to lowercase hexadecimal string
    END
    ELSE 
        SET @Result = 'InvalidCredentials';

    -- Check account status
    IF @Result = 'LoginSuccess' AND @IsLocked = 1
    SET @Result = 'Locked';
    ELSE IF @LoginAttempts >= 10 
    SET @Result = 'TooManyAttempts';
    ELSE 

    -- Update login attempts, token, and last login IP
    IF @Result = 'LoginSuccess' 
    BEGIN
        UPDATE AccountTable SET LoginAttempts = 0, Token = @Token, LastLoginIP = @LastLoginIP, LastLogin = @Now WHERE (WindyCode = @Identifier OR Email = @Identifier);
    END
    ELSE IF @Result = 'InvalidCredentials' 
    BEGIN
        UPDATE AccountTable SET LoginAttempts = @LoginAttempts + 1, LastLogin = @Now WHERE (WindyCode = @Identifier OR Email = @Identifier);
    END

    COMMIT TRANSACTION;
END TRY
BEGIN CATCH
    ROLLBACK TRANSACTION;
    SET @Result = 'TransactionFailed';
END CATCH

SELECT @Result as Result, @WindyCode as WindyCode, @AuthID as AuthID, @Token as Token;
END