import crypto from 'node:crypto';

export function staffKey() {
  return process.env.STAFF_KEY || process.env.ADMIN_KEY || 'admin-dev-key';
}

export function sessionToken() {
  return crypto.createHmac('sha256', staffKey()).update('verae-staff').digest('hex');
}

export function cookieHeader() {
  return `staff_session=${sessionToken()}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;
}

export function cookieOk(req) {
  const raw = req.headers?.cookie || '';
  const m = /(?:^|; )staff_session=([^;]+)/.exec(raw);
  return Boolean(m && m[1] === sessionToken());
}

export function headerOk(req) {
  const k = req.headers?.['x-staff-key'];
  return k === staffKey();
}

export function allowed(req) {
  return cookieOk(req) || headerOk(req);
}