import { createHmac, timingSafeEqual } from "node:crypto";
import {
  archiveMetadataSchema,
  type ArchiveMetadata,
} from "../shared/map-archive";

export function archiveSignature(value: ArchiveMetadata, key: string) {
  const { signature: _signature, ...metadata } =
    archiveMetadataSchema.strip().parse(value);
  return createHmac("sha256", key)
    .update("minegeo-map-share/v1\n")
    .update(JSON.stringify(metadata))
    .digest("hex");
}
export function verifyArchiveSignature(value: ArchiveMetadata, key: string) {
  const expected = Buffer.from(archiveSignature(value, key), "hex");
  const supplied = Buffer.from(value.signature, "hex");
  if (
    expected.length !== supplied.length ||
    !timingSafeEqual(expected, supplied)
  )
    throw new Error("Map ZIP ownership verification failed");
}