// SMTP credential derivation. SES's SMTP password is not issued by an API —
// it is a deterministic function of the IAM secret access key and the
// region, which is why this package can hand an app working SMTP
// credentials without a second AWS call, and why the secret itself never
// needs to be stored anywhere (spec §3, §4).
package mail

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
)

// The four constants of AWS's published derivation. smtpDate is a literal
// "11111111" and NOT today's date — SES fixed it so the password does not
// expire; using a real date silently produces a credential SES rejects.
const (
	smtpDate     = "11111111"
	smtpService  = "ses"
	smtpTerminal = "aws4_request"
	smtpMessage  = "SendRawEmail"
	smtpVersion  = 0x04
)

func hmac256(key []byte, data string) []byte {
	h := hmac.New(sha256.New, key)
	h.Write([]byte(data))
	return h.Sum(nil)
}

// SMTPPassword derives the SES SMTP password for an IAM secret access key
// in region. The matching SMTP username is the access key ID, unmodified.
//
// The signing chain is date → region → service → terminal → message, seeded
// with "AWS4"+secret, and the result is the version byte followed by the
// HMAC. Every step is load-bearing and the order is not negotiable.
func SMTPPassword(secretKey, region string) string {
	sig := []byte("AWS4" + secretKey)
	for _, step := range []string{smtpDate, region, smtpService, smtpTerminal, smtpMessage} {
		sig = hmac256(sig, step)
	}
	return base64.StdEncoding.EncodeToString(append([]byte{smtpVersion}, sig...))
}