/* Copyright © 2024 Apeleg Limited. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License") with LLVM
 * exceptions; you may not use this file except in compliance with the
 * License. You may obtain a copy of the License at
 *
 * http://llvm.org/foundation/relicensing/LICENSE.txt
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

import browserSandbox from '@apeleghq/lot/browser';
import * as deriveKek from 'inline:~/sandbox/deriveKek.js';
import * as fileEncryptionCms from 'inline:~/sandbox/fileEncryptionCms.js';
import * as zip from 'inline:~/sandbox/zip.js';
import getWrappedCryptoFunctions from './getWrappedCryptoFunctions.js';
import {
	deriveKek$SEP_,
	external$deriveKey$SEP_,
	external$encrypt$SEP_,
	external$exportKey$SEP_,
	external$generateKey$SEP_,
	external$importKey$SEP_,
	fileEncryptionCms$SEP_,
	zip$SEP_,
} from './sandboxEntrypoints.js';

const setupEncryptionSandbox_ = async (
	passwordGetter: { (): string },
	iterationCountGetter: { (): number },
	signal?: AbortSignal,
) => {
	const wrappedCryptoFunctions = getWrappedCryptoFunctions();

	const [deriveKekSandbox, zipSandbox] = await Promise.all([
		browserSandbox<{
			[deriveKek$SEP_]: {
				(
					password: string,
					iterationCount: number,
					keyUsages: KeyUsage[],
					salt?: Uint8Array | undefined,
				): [KEK: CryptoKey, salt: Uint8Array, iterationCount: number];
			};
		}>(
			deriveKek.default,
			null,
			{
				[external$deriveKey$SEP_]: wrappedCryptoFunctions.deriveKey_,
				[external$importKey$SEP_]: wrappedCryptoFunctions.importKey_,
			},
			signal,
		),
		browserSandbox<{
			[zip$SEP_]: {
				(
					name: string,
					contents: AllowSharedBufferSource,
				): AllowSharedBufferSource;
			};
		}>(zip.default, null, null, signal),
	]);

	const encryptionSandbox = await browserSandbox<{
		[fileEncryptionCms$SEP_]: {
			(
				data: AllowSharedBufferSource,
			): [
				salt: AllowSharedBufferSource,
				iterationCount: number,
				ivPWRI: AllowSharedBufferSource,
				encryptedKey: AllowSharedBufferSource,
				nonceECI: AllowSharedBufferSource,
				encryptedContent: AllowSharedBufferSource,
				tag: AllowSharedBufferSource,
			];
		};
	}>(
		fileEncryptionCms.default,
		null,
		{
			[deriveKek$SEP_]: () => {
				return deriveKekSandbox(
					deriveKek$SEP_,
					passwordGetter(),
					iterationCountGetter(),
					['encrypt'],
				);
			},
			[external$encrypt$SEP_]: wrappedCryptoFunctions.encrypt_,
			[external$exportKey$SEP_]: wrappedCryptoFunctions.exportKey_,
			[external$generateKey$SEP_]: wrappedCryptoFunctions.generateKey_,
		},
		signal,
	);

	const encrypt = async (
		name: string,
		data: AllowSharedBufferSource,
	): Promise<
		[
			salt: AllowSharedBufferSource,
			iterationCount: number,
			ivPWRI: AllowSharedBufferSource,
			encryptedKey: AllowSharedBufferSource,
			nonceECI: AllowSharedBufferSource,
			encryptedContent: AllowSharedBufferSource,
			tag: AllowSharedBufferSource,
		]
	> => {
		const archive = await zipSandbox(zip$SEP_, name, data);

		return encryptionSandbox(fileEncryptionCms$SEP_, archive);
	};

	return encrypt;
};

export default setupEncryptionSandbox_;