// Caller attestation: Pinboard-From claims verified against the caller's
// session secret and placement before riding onward as Pinboard-Caller.

import {
  DEPTH_HEADER,
  FROM_HEADER,
  SESSION_HEADER,
  SESSION_SECRET_HEADER,
} from "./proxy.js";
import { invalidIdReason, parseRoute } from "./router.js";
import { sha256Bytes, timingSafeEqualBytes } from "./hash.js";
import { parsePlacementRow, type Keys, type WorkerRecord } from "./keys.js";
import { logger } from "./logger.js";

export const MAX_DEPTH = 50;

const secretEquals = (a: string, b: string): boolean =>
  timingSafeEqualBytes(sha256Bytes(a), sha256Bytes(b));
const header = (req: Request, name: string): string | undefined =>
  req.headers.get(name) ?? undefined;

export const createAttestor = (deps: {
  keys: Keys;
  hget(key: string, field: string): Promise<string | null>;
  worker(sessionId: string): Promise<WorkerRecord | null>;
}) => {
  const { keys } = deps;
  return async (
    req: Request,
  ): Promise<
    | {
        caller?: string;
        sessionId?: string;
        depth?: string | undefined;
        worker?: WorkerRecord;
      }
    | { error: string }
  > => {
    const from = header(req, FROM_HEADER);
    if (from === undefined) return {};
    const depth = header(req, DEPTH_HEADER);
    if (depth !== undefined && !/^\d{1,9}$/.test(depth)) {
      return { error: "malformed subrequest depth" };
    }
    const sessionId = header(req, SESSION_HEADER);
    const secret = header(req, SESSION_SECRET_HEADER);
    if (sessionId === undefined || secret === undefined) {
      return { error: "caller attestation requires session credentials" };
    }
    const worker = await deps.worker(sessionId);
    if (worker === null) return { error: "unknown session" };
    if (!secretEquals(secret, worker.secret)) {
      return { error: "invalid session secret" };
    }
    const claim = parseRoute(from);
    if (
      claim === null ||
      claim.rest !== "" ||
      invalidIdReason(claim.id) !== null
    ) {
      return { error: "malformed caller claim" };
    }
    const env = worker.envs[claim.ns];
    if (env === undefined) return { error: "caller placement mismatch" };
    const row = await deps.hget(
      keys.placements(keys.bucket(claim.id), env, claim.ns),
      claim.id,
    );
    const placement = row === null ? null : parsePlacementRow(row);
    if (placement === null || placement.sessionId !== sessionId) {
      return { error: "caller placement mismatch" };
    }
    return { caller: `${claim.ns}/${claim.id}`, sessionId, depth, worker };
  };
};

export const depthExceeded = (
  attested: { caller?: string; depth?: string | undefined },
  match: { ns: string; id: string },
): boolean => {
  if (attested.depth === undefined || Number(attested.depth) <= MAX_DEPTH) {
    return false;
  }
  logger.error(
    {
      operation: "forward",
      namespace: match.ns,
      id: match.id,
      caller: attested.caller,
      depth: attested.depth,
    },
    "subrequest depth exceeded",
  );
  return true;
};