'use strict';
const channel=require('../../packages/core/policy-channel.cjs');
const fs=require('node:fs');
function deploymentPin(){if(process.env.SAFETYNET_REQUIRE_CHANNEL_PIN==='true'&&!process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE)throw Error('Deployment requires a protected management signing pin');return process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE?fs.readFileSync(process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE,'utf8').trim():undefined;}
async function protectedPolicyRequest({device,request,save}){
  const pin=deploymentPin();if(pin&&device.channelSignatureKey&&device.channelSignatureKey.trim()!==pin)throw Error('Protected management signing pin mismatch');
  if(!device.channelSignatureKey){
    // One-time legacy migration is authenticated by the enrollment signing pin and HTTPS.
    const identity=await request(device.server,'/api/device/channel/identity',null,device.token);
    channel.verifyIdentity(identity,device.publicKey);if(pin&&identity.signatureKey.trim()!==pin)throw Error('Protected management signing pin mismatch');
    device.channelSignatureKey=identity.signatureKey;save(device);
  }
  const challenge=await request(device.server,'/api/device/channel/challenge',{},device.token);
  channel.verifyChallenge(challenge,device.id,device.publicKey,device.channelSignatureKey);
  const context=channel.prepare(challenge);
  try{const response=await request(device.server,'/api/device/channel/policy',context.request,device.token);return channel.finish(response,challenge,context);}
  finally{context.responseKey.fill(0);}
}
module.exports={protectedPolicyRequest,deploymentPin};