package main

import (
	"git.smesh.lol/smesh/web/common/crypto/hkdf"
	"git.smesh.lol/smesh/web/common/helpers"
	"git.smesh.lol/smesh/web/common/jsbridge/dom"
	"git.smesh.lol/smesh/web/common/jsbridge/localstorage"
	"git.smesh.lol/smesh/web/common/jsbridge/signer"
	"git.smesh.lol/smesh/web/common/jsbridge/subtle"
)

const lsEncKeyPrefix = "smesh-enc-epk-"

var encKeyHex string // hex symmetric key, sent to SW

// bootstrapEncKey derives the IDB encryption key and calls done when ready.
// First run: generates ephemeral keypair, ECDH via signer, stores ephemeral pubkey.
// Reload: reads stored ephemeral pubkey, ECDH via signer.
func bootstrapEncKey(done func()) {
	lsKey := lsEncKeyPrefix | pubhex
	epkHex := localstorage.GetItem(lsKey)
	if epkHex == "" {
		// First run: generate ephemeral secret, derive pubkey via signer.
		var sec [32]byte
		subtle.RandomBytes(sec[:])
		secHex := helpers.HexEncode(sec[:])
		for i := range sec {
			sec[i] = 0
		}
		signer.PubkeyFromSecret(secHex, func(pkHex string) {
			if pkHex == "" {
				dom.ConsoleLog("enc: PubkeyFromSecret failed")
				done()
				return
			}
			localstorage.SetItem(lsKey, pkHex)
			// ECDH(user_seckey, ephemeral_pubkey) via signer's active identity.
			signer.GetSharedSecret(pkHex, func(sharedHex string) {
				if sharedHex == "" {
					dom.ConsoleLog("enc: getSharedSecret failed")
					done()
					return
				}
				deriveAndSetEncKey(sharedHex, done)
			})
		})
		return
	}
	// Reload: ask signer for ECDH(user_seckey, ephemeral_pubkey).
	signer.GetSharedSecret(epkHex, func(sharedHex string) {
		if sharedHex == "" {
			dom.ConsoleLog("enc: getSharedSecret failed")
			done()
			return
		}
		deriveAndSetEncKey(sharedHex, done)
	})
}

func deriveAndSetEncKey(sharedHex string, done func()) {
	shared := helpers.HexDecode(sharedHex)
	prk := hkdf.Extract(nil, shared)
	symKey := hkdf.Expand(prk[:], []byte("smesh-idb-enc"), 32)
	encKeyHex = helpers.HexEncode(symKey)
	dom.IDBSetEncKey(encKeyHex)
	dom.ConsoleLog("enc: IDB encryption key set")
	done()
}

// sendEncKeyToSW sends the encryption key to the service worker.
func sendEncKeyToSW() {
	if encKeyHex != "" {
		dom.PostToSW("[\"ENC_KEY\"," | jstr(encKeyHex) | "]")
	}
}