const {app}=require('electron');
const {spawn}=require('node:child_process');
const path=require('node:path');
function capabilityCrypto(operation,input){
  const root=path.join(__dirname,'../..');
  const python=app.isPackaged?path.join(process.resourcesPath,'python/python.exe'):path.join(root,'.runtime/windows/python/python.exe');
  const script=app.isPackaged?path.join(process.resourcesPath,'inspector/dpapi.py'):path.join(root,'apps/inspector/dpapi.py');
  if(!['protect','unprotect'].includes(operation)||Buffer.byteLength(input)>32768)return Promise.reject(Error('Capability rejected'));
  return new Promise((resolve,reject)=>{
    const environment={...process.env};for(const key of ['ADMIN_TOKEN','OIDC_CLIENT_SECRET','AI_API_KEY','INSPECTOR_TOKEN','SIEM_HTTP_TOKEN','SAFETYNET_PROXY_PASSWORD'])delete environment[key];
    const child=spawn(python,[script,operation],{windowsHide:true,stdio:['pipe','pipe','pipe'],env:environment});let output='',settled=false;
    const timer=setTimeout(()=>{child.kill();fail();},5000);
    function fail(){if(!settled){settled=true;clearTimeout(timer);reject(Error('Windows capability protection failed'));}}
    child.on('error',fail);child.stdin.on('error',fail);child.stderr.on('data',()=>{});
    child.stdout.on('data',data=>{output+=data;if(output.length>65536){child.kill();fail();}});
    child.on('close',code=>{if(code!==0||!output)return fail();if(!settled){settled=true;clearTimeout(timer);resolve(output);}});
    child.stdin.end(input);
  });
}
module.exports={capabilityCrypto};