package hostfence

import (
	"bytes"
	"encoding/json"
	"github.com/carlosframework/platform/internal/hostfloor"
	"io"
	"os"
	"path/filepath"
)

func ValidateActivationCredentials(raw []byte, bucket, region, role string) error {
	c, err := decodeFenceCredentials(bytes.NewReader(raw), bucket)
	if err != nil {
		return err
	}
	if region == "" || role == "" || c.Region != region || c.Role != role {
		return os.ErrPermission
	}
	return nil
}

func ActivationCredentialReceipt(raw []byte) []byte {
	receipt, _ := json.Marshal(struct {
		V      int    `json:"v"`
		SHA256 string `json:"sha256"`
	}{1, hostfloor.Digest(raw)})
	return receipt
}
func VerifyActivationCredentialReceipt(raw, receipt []byte) bool {
	return bytes.Equal(receipt, ActivationCredentialReceipt(raw))
}
func activationCredentialReader(f *os.File) (io.Reader, error) {
	raw, err := io.ReadAll(io.LimitReader(f, 16385))
	if err != nil || len(raw) > 16384 {
		return nil, os.ErrPermission
	}
	receipt, err := hostfloor.OpenProtected(filepath.Join(filepath.Dir(f.Name()), "credentials.installation.json"))
	if err != nil {
		return nil, err
	}
	defer receipt.Close()
	st, err := receipt.Stat()
	if err != nil || st.Mode().Perm() != 0600 {
		return nil, os.ErrPermission
	}
	wire, err := io.ReadAll(io.LimitReader(receipt, 1025))
	if err != nil || !VerifyActivationCredentialReceipt(raw, wire) {
		return nil, os.ErrPermission
	}
	return bytes.NewReader(raw), nil
}