using System.Security.Cryptography;
using System.Text;
using DodoSSH.Client.Session;

namespace DodoSSH.Client.App.Platform;

/// <summary>
/// What a platform key store calls the hardware key behind one profile's device unlock.
/// </summary>
/// <remarks>
/// <para>
/// ◆ <b>One key per profile, because the key outlives the file and is shared by name.</b> The CNG key and
/// the Secure Enclave keychain item are found by name in a store that belongs to the user, not to the
/// profile directory. While every profile used the same name, the release build and the nightly — which
/// <see cref="ClientPaths.ForChannel"/> keeps apart precisely so neither can damage the other — shared one
/// key: signing out of either deleted it, and the other's device unlock silently stopped working.
/// </para>
/// <para>
/// <b>The default profile keeps the name it has always had</b>, so an existing install's sealed key still
/// opens. Every other profile gets that name with a digest of its directory on the end — a digest rather
/// than the directory's own name, because a portable copy can live in any folder and two such folders can
/// end in the same name.
/// </para>
/// </remarks>
internal static class DeviceKeyNames
{
    /// <summary>The name of the key behind <paramref name="paths"/>' device unlock.</summary>
    /// <param name="paths">The profile.</param>
    /// <param name="legacy">The name every profile used before names were per profile.</param>
    internal static string For(ClientPaths paths, string legacy)
    {
        ArgumentNullException.ThrowIfNull(paths);

        var directory = Normalise(paths.DataDirectory);

        if (string.Equals(directory, Normalise(ClientPaths.Default.DataDirectory), StringComparison.OrdinalIgnoreCase))
        {
            return legacy;
        }

        var digest = SHA256.HashData(Encoding.UTF8.GetBytes(directory.ToUpperInvariant()));

        return $"{legacy}.{Convert.ToHexStringLower(digest.AsSpan(0, 8))}";
    }

    private static string Normalise(string directory) =>
        Path.TrimEndingDirectorySeparator(Path.GetFullPath(directory));
}