import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifySignature(rawBody, signature, secret) {
  if (!secret) return false;
  if (!signature) return false;
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(String(signature), 'utf8');
  return a.length === b.length && timingSafeEqual(a, b);
}

const ZERO_SHA = /^0+$/;

// Turn a Gitea webhook (event header + payload) into a review job, or null if
// the event is not reviewable.
export function jobFromWebhook(event, payload) {
  if (event === 'push') {
    const after = payload.after;
    if (!after || ZERO_SHA.test(after)) return null; // branch delete
    const [owner, repo] = String(payload.repository?.full_name || '').split('/');
    if (!owner || !repo) return null;
    const commits = Array.isArray(payload.commits) ? payload.commits : [];
    if (commits.length === 0) return null; // e.g. tag push / empty
    return {
      event: 'push',
      owner, repo,
      sha: after,
      ref: payload.ref,
      before: payload.before,
      defaultBranch: payload.repository?.default_branch || null,
      prIndex: null,
      prTitle: null,
      pusher: payload.pusher?.username || payload.pusher?.login || null,
      authors: dedupe(commits.map(c => c.author?.name || c.author?.email).filter(Boolean)),
      commitShas: commits.map(c => c.id).filter(Boolean),
      commitMessages: commits.map(c => c.message || '')
    };
  }
  if (event === 'pull_request') {
    const action = payload.action;
    if (!['opened', 'synchronize', 'synchronized', 'reopened'].includes(action)) return null;
    const pr = payload.pull_request;
    if (!pr) return null;
    const [owner, repo] = String(payload.repository?.full_name || '').split('/');
    if (!owner || !repo) return null;
    return {
      event: `pull_request/${action}`,
      owner, repo,
      sha: pr.head?.sha,
      ref: pr.head?.ref,
      before: null,
      defaultBranch: payload.repository?.default_branch || null,
      prIndex: pr.number,
      prTitle: pr.title || null,
      pusher: payload.sender?.username || payload.sender?.login || null,
      authors: dedupe([pr.user?.username || pr.user?.login].filter(Boolean)),
      commitShas: [pr.head?.sha].filter(Boolean),
      commitMessages: [pr.title || '', pr.body || '']
    };
  }
  return null;
}

function dedupe(a) { return [...new Set(a)]; }