/**
 * Auth, host-allow, and static-route helpers shared between the Bun listener
 * (serve.ts) and the Node listener used by the desktop sidecar (serve-node.ts).
 */
import { timingSafeEqual } from "node:crypto";

export const DEFAULT_ALLOWED_HOSTS: ReadonlyArray<string> = [
  "localhost",
  "127.0.0.1",
  "[::1]",
  "::1",
];

const LOOPBACK_BIND_HOSTS = new Set<string>(["localhost", "127.0.0.1", "[::1]", "::1"]);

export const normalizeCredential = (value: string | undefined): string | null => {
  const normalized = value?.trim();
  return normalized && normalized.length > 0 ? normalized : null;
};

export const safeEqual = (actual: string, expected: string): boolean => {
  const actualBytes = Buffer.from(actual);
  const expectedBytes = Buffer.from(expected);
  return actualBytes.length === expectedBytes.length && timingSafeEqual(actualBytes, expectedBytes);
};

export const isLoopbackBindHost = (hostname: string): boolean =>
  LOOPBACK_BIND_HOSTS.has(hostname.trim().toLowerCase());

export const makeIsAllowedHost =
  (allowed: ReadonlySet<string>) =>
  (request: Request): boolean => {
    const host = request.headers.get("host");
    if (!host) return true;
    const hostname = host.replace(/:\d+$/, "");
    return allowed.has(hostname);
  };

export const hasBearerToken = (request: Request, token: string): boolean => {
  const authorization = request.headers.get("authorization");
  const bearer = authorization?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();
  return (
    (bearer !== undefined && safeEqual(bearer, token)) ||
    safeEqual(request.headers.get("x-executor-token") ?? "", token)
  );
};

export const hasBasicPassword = (request: Request, password: string): boolean => {
  const authorization = request.headers.get("authorization");
  const encoded = authorization?.match(/^Basic\s+(.+)$/i)?.[1]?.trim();
  if (!encoded) return false;

  let decoded: string;
  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: Basic auth decoding accepts untrusted header bytes
  try {
    decoded = Buffer.from(encoded, "base64").toString("utf8");
  } catch {
    return false;
  }

  const separator = decoded.indexOf(":");
  const actualPassword = separator >= 0 ? decoded.slice(separator + 1) : decoded;
  return safeEqual(actualPassword, password);
};

export interface AuthCredentials {
  readonly token: string | null;
  readonly password: string | null;
}

export const makeIsAuthorized =
  (auth: AuthCredentials) =>
  (request: Request): boolean =>
    (auth.token !== null && hasBearerToken(request, auth.token)) ||
    (auth.password !== null && hasBasicPassword(request, auth.password));

export const hasFileExtension = (pathname: string): boolean => {
  const lastSegment = pathname.split("/").at(-1) ?? "";
  return lastSegment.includes(".");
};

/**
 * OAuth provider callbacks land here from the user's external browser,
 * which has no way to send our Basic auth header. The `state` parameter
 * is the cryptographic gate — each in-flight session is server-issued
 * and validated by the shared `completeOAuth` before any work happens.
 * Bypassing Basic auth on these paths is safe.
 *
 * Matches:
 * - `/api/oauth/callback` — the shared OAuth API mount point.
 * - `/api/oauth/await/<sessionId>` — polled by the Electron renderer
 *   when the user runs the flow in their system browser. The sessionId
 *   is the cryptographic flow id; results are one-shot, so a leaked
 *   poll without a matching active flow returns null.
 */
export const isUnauthenticatedOAuthCallbackPath = (pathname: string): boolean =>
  /^\/api\/oauth\/(callback|await)(\/|$)/.test(pathname);