package cluster

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"strconv"
	"strings"
	"time"
)

const (
	agentHeaderTS        = "X-Observer-Ts"
	agentHeaderNonce     = "X-Observer-Nonce"
	agentHeaderSignature = "X-Observer-Signature"
)

func applyAgentRequestAuth(req *http.Request, c Cluster) {
	if req == nil {
		return
	}
	if strings.TrimSpace(c.Agent.Token) != "" {
		req.Header.Set("Authorization", "Bearer "+c.Agent.Token)
	}
	secret := strings.TrimSpace(c.Agent.RequestSecret)
	if secret == "" {
		return
	}

	ts := strconv.FormatInt(time.Now().UTC().Unix(), 10)
	nonce := randomHex(12)
	payload := req.Method + "\n" + req.URL.RequestURI() + "\n" + ts + "\n" + nonce

	mac := hmac.New(sha256.New, []byte(secret))
	_, _ = mac.Write([]byte(payload))
	sig := hex.EncodeToString(mac.Sum(nil))

	req.Header.Set(agentHeaderTS, ts)
	req.Header.Set(agentHeaderNonce, nonce)
	req.Header.Set(agentHeaderSignature, sig)
}