import { createHmac, timingSafeEqual } from "node:crypto";

function secret() {
  return process.env.SESSION_SECRET ?? process.env.DATABASE_URL ?? "";
}

export function signSession(payload: string) {
  const key = secret();
  if (!key) throw new Error("SESSION_SECRET is required");
  const encoded = Buffer.from(payload).toString("base64url");
  const signature = createHmac("sha256", key).update(encoded).digest("base64url");
  return `${encoded}.${signature}`;
}

export function verifySession(token?: string) {
  if (!token) return null;
  const [encoded, signature] = token.split(".");
  if (!encoded || !signature || !secret()) return null;
  const expected = createHmac("sha256", secret()).update(encoded).digest();
  const supplied = Buffer.from(signature, "base64url");
  if (expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) return null;
  try { return Buffer.from(encoded, "base64url").toString(); } catch { return null; }
}

export function adminSessionValue() {
  return signSession("admin:trust-world-operations:v1");
}