import { createHash } from 'node:crypto';
import { getOrCreateMasterKey } from './master-key';

/**
 * Derive Ansible Vault password from master key
 *
 * Policy function (Rule 10.1) - pure computation
 *
 * Uses a deterministic derivation so the same master key always
 * produces the same vault password. This ensures generated artifacts
 * can be consistently encrypted/decrypted.
 *
 * @param masterKey - 32-byte master key
 * @returns Vault password as string
 */
export function deriveVaultPassword(masterKey: Buffer): string {
  if (!Buffer.isBuffer(masterKey) || masterKey.length !== 32) {
    throw new Error('Master key must be 32 bytes');
  }

  // Use SHA-256 to derive a deterministic password from master key
  // Prefix with "ansible-vault:" for domain separation
  const hash = createHash('sha256');
  hash.update('ansible-vault:');
  hash.update(masterKey);

  // Return as hex string (64 characters)
  return hash.digest('hex');
}

/**
 * Get Ansible Vault password
 *
 * Orchestration function - combines key retrieval and derivation
 *
 * @param masterKeyPath - Optional master key path
 * @returns Vault password as string
 */
export async function getVaultPassword(masterKeyPath?: string): Promise<string> {
  const masterKey = await getOrCreateMasterKey(masterKeyPath);
  return deriveVaultPassword(masterKey);
}