/**
 * Utility per la firma digitale utilizzando Web Crypto API (ECDSA P-256)
 */

const KEY_ALGO = {
  name: "ECDSA",
  namedCurve: "P-256",
};

const SIGN_ALGO = {
  name: "ECDSA",
  hash: { name: "SHA-256" },
};

// SECURITY:
// - Never persist private keys in localStorage/sessionStorage.
// - For real legal validity, signing must be performed server-side (HSM/KMS).
// This client-side keypair is kept IN MEMORY only and is suitable only for demo/dev.
let inMemoryKeyPair: CryptoKeyPair | null = null;

export async function getPlatformKeyPair(): Promise<CryptoKeyPair> {
  if (inMemoryKeyPair) return inMemoryKeyPair;
  // NOTE: extractable=true is needed to export the PUBLIC key.
  // We still keep private key only in memory.
  const keys = await crypto.subtle.generateKey(KEY_ALGO, true, ["sign", "verify"]);
  inMemoryKeyPair = keys;
  return keys;
}

export async function signCertificateData(data: string, privateKey: CryptoKey): Promise<string> {
  const encoder = new TextEncoder();
  const encodedData = encoder.encode(data);
  const signature = await crypto.subtle.sign(SIGN_ALGO, privateKey, encodedData);
  return btoa(String.fromCharCode(...new Uint8Array(signature)));
}

export async function verifySignature(data: string, signatureBase64: string, publicKeyJwk: string): Promise<boolean> {
  try {
    const publicKey = await crypto.subtle.importKey(
      "jwk", 
      JSON.parse(atob(publicKeyJwk)), 
      KEY_ALGO, 
      true, 
      ["verify"]
    );
    const encoder = new TextEncoder();
    const encodedData = encoder.encode(data);
    const signature = Uint8Array.from(atob(signatureBase64), c => c.charCodeAt(0));
    
    return await crypto.subtle.verify(SIGN_ALGO, publicKey, signature, encodedData);
  } catch (e) {
    console.error("Verification error", e);
    return false;
  }
}

export async function exportPublicKeyAsJwk(publicKey: CryptoKey): Promise<string> {
  const jwk = await crypto.subtle.exportKey("jwk", publicKey);
  return btoa(JSON.stringify(jwk));
}