import { createHmac, timingSafeEqual } from "crypto";

/**
 * Pure helpers for the admin session cookie token. Kept free of `next/headers`
 * and the database so the middleware (`proxy.ts`) can verify a session without
 * pulling the server-only auth module into the edge/middleware bundle.
 */
export const ADMIN_SESSION_COOKIE = "moh_admin_session";
export const ADMIN_SESSION_VALUE = "superadmin";

function getSecret(): string {
  return process.env.ADMIN_AUTH_SECRET ?? "";
}

function signValue(value: string): string {
  return createHmac("sha256", getSecret()).update(value).digest("hex");
}

export function buildAdminSessionToken(): string {
  return `${ADMIN_SESSION_VALUE}.${signValue(ADMIN_SESSION_VALUE)}`;
}

export function verifyAdminSessionToken(token: string | undefined | null): boolean {
  if (!token || !getSecret()) {
    return false;
  }

  const parts = token.split(".");
  if (parts.length !== 2) {
    return false;
  }

  const [value, signature] = parts;
  if (value !== ADMIN_SESSION_VALUE) {
    return false;
  }

  const expected = signValue(value);
  const left = Buffer.from(signature);
  const right = Buffer.from(expected);

  if (left.length !== right.length) {
    return false;
  }

  return timingSafeEqual(left, right);
}