import { createPublicKey, verify } from "node:crypto";

const b64u = (s: string) => Buffer.from(s, "base64url");
const SPKI = Buffer.from("302a300506032b6570032100", "hex"); // Ed25519 SubjectPublicKeyInfo prefix

/** req: the x402 payment requirement the payer accepted (payTo, extra.mizan); keys: {kid: base64 Ed25519 public key},
 *  your pinned copy of /.well-known/mizan-keys.json; rule: the rule hash you require (sha256:...). Offline. */
export function mizanVerdictOk(req: any, keys: Record<string, string>, rule: string, token?: string, now = Date.now() / 1000) {
  const m = req?.extra?.mizan ?? {}, t: string = token ?? m.token ?? "";
  const [pre, body, sig] = t.split(".");
  let c: any;
  try {
    c = JSON.parse(b64u(body).toString("utf8"));
    const key = createPublicKey({ key: Buffer.concat([SPKI, Buffer.from(keys[c.kid], "base64")]), format: "der", type: "spki" });
    if (!verify(null, Buffer.from(`${pre}.${body}`, "ascii"), key, b64u(sig))) return { ok: false, code: "bad_token" };
  } catch { return { ok: false, code: "bad_token" }; }
  const norm = (s: unknown) => { const v = String(s ?? ""); return v.toLowerCase().startsWith("0x") ? v.toLowerCase() : v; };
  if (pre !== "mzv1" || c.typ !== "mizan.verdict/1") return { ok: false, code: "malformed" };
  if (m.kid && m.kid !== c.kid) return { ok: false, code: "kid_mismatch" };
  if (!(c.exp > now)) return { ok: false, code: "expired" };
  if (!req?.payTo || norm(c.bound_to?.payee) !== norm(req.payTo)) return { ok: false, code: "payee_mismatch" };
  if (c.bound_to?.rule !== rule) return { ok: false, code: "rule_mismatch" };
  return c.decision === "ALLOW" ? { ok: true, code: "valid" } : { ok: false, code: "refused" };
}