package update

import (
	domain "RenewCMS/internal/domain/update"
	"crypto/ed25519"
	"encoding/base64"
	"errors"
	"os"
	"strings"
)

var (
	errSignatureEncoding = errors.New("the signature is not a base64 encoded ed25519 signature")
	errSignatureMismatch = errors.New("the signature does not match the checksums file")
)

type Ed25519SignatureVerifier struct {
	key ed25519.PublicKey
}

var _ domain.SignatureVerifier = &Ed25519SignatureVerifier{}

func NewEd25519SignatureVerifier(key ed25519.PublicKey) *Ed25519SignatureVerifier {
	return &Ed25519SignatureVerifier{key: key}
}

func (v *Ed25519SignatureVerifier) Verify(checksumsPath string, signaturePath string) error {
	content, err := os.ReadFile(checksumsPath)
	if err != nil {
		return err
	}
	rawSignature, err := os.ReadFile(signaturePath)
	if err != nil {
		return err
	}
	signature, err := base64.StdEncoding.DecodeString(strings.TrimSpace(string(rawSignature)))
	if err != nil || len(signature) != ed25519.SignatureSize {
		return errSignatureEncoding
	}
	if len(v.key) != ed25519.PublicKeySize || !ed25519.Verify(v.key, content, signature) {
		return errSignatureMismatch
	}
	return nil
}