import { createHmac, timingSafeEqual } from "node:crypto";

const PREFIX = "rgb1.";

/** Opaque run-scoped token for the sandbox GitHub broker (not a GitHub PAT). */
export function signGithubBrokerRunToken(runId: string, secret: string): string {
  const digest = createHmac("sha256", secret).update(runId, "utf8").digest("base64url");
  return `${PREFIX}${digest}`;
}

export function verifyGithubBrokerRunToken(token: string, secret: string, runId: string): boolean {
  if (!token.startsWith(PREFIX)) return false;
  const expected = signGithubBrokerRunToken(runId, secret);
  const a = Buffer.from(token, "utf8");
  const b = Buffer.from(expected, "utf8");
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}