import crypto from 'node:crypto';

export function staffKey() {
  return process.env.STAFF_KEY || process.env.ADMIN_KEY || 'admin-dev-key';
}

export function sessionToken() {
  return crypto.createHmac('sha256', staffKey()).update('verae-staff').digest('hex');
}

export function cookieHeader() {
  let s = `staff_session=${sessionToken()}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;
  const domain = process.env.STAFF_COOKIE_DOMAIN;
  if (domain) s += `; Domain=${domain}`;
  if (process.env.STAFF_COOKIE_SECURE === '1') s += '; Secure';
  return s;
}

export function cookieOk(req) {
  const raw = req.headers?.cookie || '';
  const m = /(?:^|; )staff_session=([^;]+)/.exec(raw);
  return Boolean(m && m[1] === sessionToken());
}

export function headerOk(req) {
  const k = req.headers?.['x-staff-key'];
  return k === staffKey();
}

export function allowed(req) {
  return cookieOk(req) || headerOk(req);
}