import { createHmac, timingSafeEqual } from 'crypto';

export const ADMIN_SESSION_COOKIE_NAME = 'yumder_admin_session';

export function getAdminSessionSecret(): string {
  const secret = process.env.ADMIN_SESSION_SECRET;
  if (!secret) {
    throw new Error('ADMIN_SESSION_SECRET ist nicht gesetzt. Der Wert muss ein langer, zufaelliger String sein.');
  }
  return secret;
}

export function signSessionId(sessionId: string, secret: string): string {
  const signature = createHmac('sha256', secret).update(sessionId).digest('hex');
  return `${sessionId}.${signature}`;
}

export function unsignSessionId(signedValue: string, secret: string): string | null {
  const lastDot = signedValue.lastIndexOf('.');
  if (lastDot === -1) return null;

  const sessionId = signedValue.slice(0, lastDot);
  const signature = signedValue.slice(lastDot + 1);
  const expected = createHmac('sha256', secret).update(sessionId).digest('hex');

  if (signature.length !== expected.length) return null;

  const sigBuf = Buffer.from(signature, 'utf-8');
  const expBuf = Buffer.from(expected, 'utf-8');

  try {
    if (!timingSafeEqual(sigBuf, expBuf)) return null;
  } catch {
    return null;
  }

  return sessionId;
}