import { readFileSync } from 'node:fs'
import { createHash } from 'node:crypto'
import { join } from 'node:path'
import { resolveAgentScriptsDir } from './agent-scripts-path.js'

export type SyncScriptMeta = {
  body: Buffer
  sha256: string
  etag: string
}

let cache: SyncScriptMeta | null = null

/** Linux sync agent script + sha256 of file bytes (process-lifetime cache). */
export function getSyncScriptMeta(): SyncScriptMeta {
  if (cache) return cache
  const dir = resolveAgentScriptsDir()
  const body = readFileSync(join(dir, 'evofw-firewall.sh'))
  const sha256 = createHash('sha256').update(body).digest('hex')
  cache = { body, sha256, etag: `"${sha256}"` }
  return cache
}

/** Compare If-None-Match with our ETag (`"<sha256>"`). */
export function ifNoneMatchHits(
  header: string | string[] | undefined,
  etag: string,
): boolean {
  if (!header) return false
  const raw = Array.isArray(header) ? header.join(',') : header
  const want = etag.replaceAll('"', '').toLowerCase()
  for (const part of raw.split(',')) {
    let token = part.trim()
    if (token.startsWith('W/')) token = token.slice(2).trim()
    token = token.replaceAll('"', '')
    if (token === '*' || token.toLowerCase() === want) return true
  }
  return false
}