/**
 * Server-side MAC key for capability + admin proof verification.
 * Derived once from SERVER_SEED after keys are loaded.
 */
import { deriveMacKey } from '../../shared/crypto-auth.js'

/** @type {Buffer|null} */
let macKey = null
/** @type {string|null} */
let seedHex = null
/** @type {string|null} */
let publicKeyHex = null

/**
 * @param {{ seedHex: string, publicKeyHex: string }} opts
 */
export function initAuthKeys({ seedHex: seed, publicKeyHex: pub }) {
  if (!seed || !/^[0-9a-fA-F]{64}$/.test(seed)) {
    throw new Error('initAuthKeys requires 64-hex seedHex')
  }
  seedHex = seed.toLowerCase()
  publicKeyHex = String(pub || '').toLowerCase()
  macKey = deriveMacKey(seedHex)
}

export function getMacKey() {
  if (!macKey) {
    // Lazy init from env (tests / late import)
    const seed = process.env.SERVER_SEED || process.env.SERVER_KEY
    if (seed && /^[0-9a-fA-F]{64}$/.test(seed)) {
      seedHex = seed.toLowerCase()
      macKey = deriveMacKey(seedHex)
      publicKeyHex = (process.env.SERVER_PUBLIC_KEY || '').toLowerCase() || null
    }
  }
  if (!macKey) throw new Error('Auth keys not initialized (SERVER_SEED missing)')
  return macKey
}

export function getSeedHex() {
  if (!seedHex) getMacKey()
  return seedHex
}

export function getServerPublicKeyHex() {
  return publicKeyHex || (process.env.SERVER_PUBLIC_KEY || '').toLowerCase() || null
}