// TURN REST credentials (draft-uberti-behave-turn-rest-00) as a #206 loader
// plugin — the JSS half of a coturn deployment. coturn relays media; this
// endpoint mints the time-limited credentials browsers use to reach it, so
// no static TURN password ever ships in a public page (a leaked credential
// expires by itself).
//
//   plugins: [{ module: 'turn/plugin.js', prefix: '/.turn',
//               config: { uris: ['turn:pod.example:3478?transport=udp',
//                                'turns:pod.example:5349'],
//                         ttl: 3600 } }]
//
// Serves `GET <prefix>/credentials[?user=<tag>]` →
//   { username, password, ttl, uris,               // the draft's shape
//     iceServers: [{ urls, username, credential }] // drop-in for RTCPeerConnection
//   }
// where username = "<unix-expiry>[:<tag>]" and
// password = base64(HMAC-SHA1(secret, username)) — exactly what coturn
// verifies under `use-auth-secret` / `static-auth-secret`.
//
// The secret comes from config.secret, or the environment variable named by
// config.secretEnv (default TURN_STATIC_AUTH_SECRET) — the env path exists
// because a CLI `--plugin module@prefix` entry carries no config object.
// `uris` may likewise come from a comma-separated TURN_URIS. Activation
// fails loudly when either is missing: a server that would mint credentials
// nobody can use (or sign them with '') must not boot quietly.
//
// Minting is anonymous by default — the point of expiry is that handing
// creds to any visitor is survivable, and the mesh pages that need them run
// without accounts. Set config.requireAuth to gate on api.auth.getAgent
// (401 for anonymous) when the relay should serve only known agents.

import crypto from 'node:crypto';

const DEFAULT_TTL = 3600; // seconds; short — clients re-mint per session
const USER_TAG = /^[A-Za-z0-9._-]{1,64}$/;

export async function activate(api) {
  const cfg = api.config || {};
  const secret = cfg.secret
    || process.env[cfg.secretEnv || 'TURN_STATIC_AUTH_SECRET']
    || '';
  if (!secret) {
    throw new Error('turn plugin: no secret — set config.secret or the '
      + `${cfg.secretEnv || 'TURN_STATIC_AUTH_SECRET'} environment variable`);
  }
  const uris = (Array.isArray(cfg.uris) && cfg.uris.length ? cfg.uris
    : String(process.env.TURN_URIS || '').split(',').map((s) => s.trim()).filter(Boolean));
  if (!uris.length) {
    throw new Error('turn plugin: no TURN uris — set config.uris or TURN_URIS');
  }
  const ttl = Number.isInteger(cfg.ttl) && cfg.ttl > 0 ? cfg.ttl : DEFAULT_TTL;
  const requireAuth = !!cfg.requireAuth;

  api.fastify.get(`${api.prefix}/credentials`, async (request, reply) => {
    if (requireAuth) {
      const agent = await api.auth.getAgent(request);
      if (!agent) return reply.code(401).send({ error: 'Unauthorized' });
    }
    const tag = request.query?.user;
    if (tag !== undefined && !USER_TAG.test(String(tag))) {
      return reply.code(400).send({ error: 'BadRequest', message: 'user must match [A-Za-z0-9._-]{1,64}' });
    }
    const username = `${Math.floor(Date.now() / 1000) + ttl}${tag ? ':' + tag : ''}`;
    const password = crypto.createHmac('sha1', secret).update(username).digest('base64');
    reply.header('cache-control', 'no-store'); // every response is a fresh, expiring grant
    return {
      username, password, ttl, uris,
      iceServers: [{ urls: uris, username, credential: password }],
    };
  });

  api.log.info(`turn: minting ${ttl}s credentials at ${api.prefix}/credentials for ${uris.length} uri(s)`);
}