package appconfig

import (
	"crypto/ecdh"
	"crypto/sha256"
	"encoding/hex"
)

// KeyFingerprint names a secrets keypair without revealing either half:
// "sha256:" and the lowercase hex SHA-256 of the public key's uncompressed
// SEC1 bytes — the same bytes CARLOS_SECRETS_PUBKEY base64-decodes to. It
// is the ONE renderer of the edges file's secrets_key_fp, shared by the
// nearest-region spec (§6.1, R9) and the move-any-app spec (§6, T2): a box
// that can open this deployment's sealed config publishes exactly the
// string the console derives from its own public key.
func KeyFingerprint(pub *ecdh.PublicKey) string {
	sum := sha256.Sum256(pub.Bytes())
	return "sha256:" + hex.EncodeToString(sum[:])
}

// PublicFingerprint is KeyFingerprint of a base64 CARLOS_SECRETS_PUBKEY.
func PublicFingerprint(b64 string) (string, error) {
	pub, err := ParsePublicKey(b64, "CARLOS_SECRETS_PUBKEY")
	if err != nil {
		return "", err
	}
	return KeyFingerprint(pub), nil
}