import { createHmac } from 'node:crypto';
import { getOrCreateMasterKey } from '../../secrets/master-key';

/**
 * Compute HMAC-SHA256 signature of data
 *
 * @param data - Data to sign
 * @param key - Secret key for HMAC
 * @returns Hex string of HMAC signature
 */
export function computeHMAC(data: string, key: Buffer): string {
  const hmac = createHmac('sha256', key);
  hmac.update(data);
  return hmac.digest('hex');
}

/**
 * Sign checksums file with master key
 *
 * @param checksumsJson - JSON string of checksums data
 * @param masterKeyPath - Optional master key path
 * @returns Hex string of HMAC signature
 */
export async function signChecksums(
  checksumsJson: string,
  masterKeyPath?: string,
): Promise<string> {
  const masterKey = await getOrCreateMasterKey(masterKeyPath);
  return computeHMAC(checksumsJson, masterKey);
}

/**
 * Verify signature of checksums file
 *
 * @param checksumsJson - JSON string of checksums data
 * @param signature - Expected signature
 * @param masterKeyPath - Optional master key path
 * @returns True if signature is valid
 */
export async function verifySignature(
  checksumsJson: string,
  signature: string,
  masterKeyPath?: string,
): Promise<boolean> {
  const expectedSignature = await signChecksums(checksumsJson, masterKeyPath);
  return signature === expectedSignature;
}