import {

  createCipheriv,

  createDecipheriv,

  createHash,

  createHmac,

  randomBytes,

  timingSafeEqual,

} from 'node:crypto';

export type GatewayGrant = {

  interactionId: string;

  senderAgentId: string;

  recipientAgentId: string;

  expiresAt: number;

};

const keyFromSecret = (secret: string) => createHash('sha256').update(secret).digest();

export function encryptGatewayPayload(secret: string, payload: unknown) {

  const iv = randomBytes(12);

  const cipher = createCipheriv('aes-256-gcm', keyFromSecret(secret), iv);

  const ciphertext = Buffer.concat([

    cipher.update(JSON.stringify(payload), 'utf8'),

    cipher.final(),

  ]);

  return {

    ciphertext: ciphertext.toString('base64url'),

    iv: iv.toString('base64url'),

    authTag: cipher.getAuthTag().toString('base64url'),

  };

}

export function decryptGatewayPayload(

  secret: string,

  encrypted: { ciphertext: string; iv: string; authTag: string },

): unknown {

  const decipher = createDecipheriv(

    'aes-256-gcm',

    keyFromSecret(secret),

    Buffer.from(encrypted.iv, 'base64url'),

  );

  decipher.setAuthTag(Buffer.from(encrypted.authTag, 'base64url'));

  return JSON.parse(

    Buffer.concat([

      decipher.update(Buffer.from(encrypted.ciphertext, 'base64url')),

      decipher.final(),

    ]).toString('utf8'),

  );

}

export function issueGatewayGrant(secret: string, grant: GatewayGrant): string {

  const payload = Buffer.from(JSON.stringify(grant)).toString('base64url');

  const signature = createHmac('sha256', secret).update(payload).digest('base64url');

  return `${payload}.${signature}`;

}

export function verifyGatewayGrant(secret: string, token: string): GatewayGrant {

  const [payload, provided] = token.split('.');

  if (!payload || !provided) throw new Error('Invalid gateway token');

  const expected = createHmac('sha256', secret).update(payload).digest();

  const actual = Buffer.from(provided, 'base64url');

  if (actual.length !== expected.length || !timingSafeEqual(actual, expected))

    throw new Error('Invalid gateway token');

  const grant = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as GatewayGrant;

  if (grant.expiresAt <= Date.now()) throw new Error('Gateway token expired');

  if (!grant.interactionId || !grant.senderAgentId || !grant.recipientAgentId)

    throw new Error('Invalid gateway token');

  return grant;

}