import {createHmac} from 'node:crypto';
import type {IncomingMessage} from 'node:http';
import type {Plugin} from 'vite';
import {boundedUserAgent,localLoginProofPayload,validClientIp} from '../lib/login-context.ts';

export function attachLocalLoginContext(request:IncomingMessage,key:string){
 // Strip caller-supplied telemetry, even when this feature is unconfigured.
 const internalHeaders=['x-planck-login-ip','x-planck-login-time','x-planck-login-proof'];
 for(const header of internalHeaders)delete request.headers[header];
 // Cloudflare's development bridge constructs the Fetch Request from rawHeaders,
 // whereas Node handlers use headers. Sanitize and update both representations.
 const raw:string[]=[];
 for(let i=0;i<request.rawHeaders.length;i+=2)if(!internalHeaders.includes(request.rawHeaders[i].toLowerCase()))raw.push(request.rawHeaders[i],request.rawHeaders[i+1]);
 request.rawHeaders=raw;
 if(key.length<32)return;
 const ip=validClientIp(request.socket.remoteAddress);if(!ip)return;
 const time=String(Date.now()),ua=boundedUserAgent(request.headers['user-agent']);
 request.headers['x-planck-login-ip']=ip;request.headers['x-planck-login-time']=time;
 request.headers['x-planck-login-proof']=createHmac('sha256',key).update(localLoginProofPayload(ip,ua,time)).digest('hex');
 for(const header of internalHeaders)request.rawHeaders.push(header,request.headers[header] as string);
}
export function loginContextDev():Plugin{return {name:'planck-local-login-context',enforce:'pre',configureServer(server){server.middlewares.use((request,_response,next)=>{if(request.url?.startsWith('/api/auth/'))attachLocalLoginContext(request,process.env.LOGIN_AUDIT_INGEST_TOKEN||'');next()})}}}