import { randomBytes, createHash } from 'node:crypto';

/**
 * API Key Service (§12.60, §9.3).
 *
 * Key format: ak_live_<32 hex chars> (e.g. ak_live_b7c41d9a6e12f4a9d83c61e0ab5c93fd)
 * Storage:    SHA-256(full_key) stored in agents.api_key_hash (CHAR(64))
 * Plaintext:  returned to agent exactly once at creation, never stored
 */

const LIVE_PREFIX = 'ak_live_';
const TEST_PREFIX = 'ak_test_';
const KEY_BYTES = 16; // 16 bytes = 32 hex chars

/** Generate a new live API key with cryptographic randomness. */
export function generateApiKey(): string {
  return LIVE_PREFIX + randomBytes(KEY_BYTES).toString('hex');
}

/** Generate a test API key. */
export function generateTestApiKey(): string {
  return TEST_PREFIX + randomBytes(KEY_BYTES).toString('hex');
}

/**
 * Hash an API key with SHA-256 for storage.
 * API keys are 256-bit entropy (not user passwords) — SHA-256 is appropriate.
 * CWE-916 suppressed: API keys are randomly generated with full entropy,
 * not user-chosen passwords vulnerable to dictionary attacks.
 * Returns 64-char hex string.
 */
export function hashApiKey(key: string): string {
  return createHash('sha256').update(key).digest('hex'); // nosemgrep: insufficient-password-hash
}

/** Validate API key format (prefix + 32 hex chars). */
export function isValidApiKeyFormat(key: string): boolean {
  if (key.length !== 40) return false;
  if (!key.startsWith(LIVE_PREFIX) && !key.startsWith(TEST_PREFIX)) return false;
  const hexPart = key.slice(8);
  return /^[0-9a-f]{32}$/.test(hexPart);
}

/**
 * Extract the prefix from an API key for safe logging (§12.92).
 * Returns first 12 chars + **** + last 4 chars.
 */
export function maskApiKeyForLog(key: string): string {
  if (key.length <= 16) return '****';
  return key.slice(0, 12) + '****' + key.slice(-4);
}
