import {readFileSync} from "node:fs";

export type ChatIdentity = {issuer: string; sub: string; username: string; name: string; email: string};
type HeaderReader = Pick<Headers, "get">;

const keyVaultUrl = process.env.KEY_VAULT_URL || "http://ai-gateway:8093";
const authentikIssuer = process.env.AUTHENTIK_ISSUER || "https://auth.xiteng.site";
const serviceTokenFile = process.env.KEY_VAULT_TOKEN_FILE || "/run/secrets/portal_gateway_hmac";
let serviceToken: string | null = null;

function loadServiceToken() {
  if (!serviceToken) serviceToken = readFileSync(/* turbopackIgnore: true */ serviceTokenFile, "utf8").trim();
  return serviceToken;
}

export function identityFromHeaders(headers: HeaderReader): ChatIdentity {
  const username = headers.get("x-authentik-username")?.trim() || "";
  const sub = headers.get("x-authentik-uid")?.trim() || "";
  if (!username || !sub) {
    const error = new Error("Authenticated user context is required");
    Object.assign(error, {statusCode: 401});
    throw error;
  }
  return {
    issuer: authentikIssuer,
    sub,
    username,
    name: headers.get("x-authentik-name")?.trim() || username,
    email: headers.get("x-authentik-email")?.trim() || ""
  };
}

export function keyVaultFetch(
  pathname: string,
  identity: ChatIdentity,
  init: {method?: string; body?: string; headers?: HeadersInit} = {}
) {
  const method = init.method || "GET";
  return fetch(new URL(pathname, keyVaultUrl), {
    method,
    headers: {
      "Accept": "application/json",
      "Authorization": `Bearer ${loadServiceToken()}`,
      ...init.headers,
      "X-Key-Vault-Actor-Issuer": identity.issuer,
      "X-Key-Vault-Actor-Sub": identity.sub,
      "X-Key-Vault-Actor-Username": identity.username
    },
    body: init.body,
    cache: "no-store",
    signal: AbortSignal.timeout(300000)
  });
}