import "server-only";

import { timingSafeEqual } from "node:crypto";

export const PASCAL_INTERNAL_SECRET_HEADER = "x-pascal-proxy-secret";

function safeEqual(left: string, right: string) {
  const leftBuffer = Buffer.from(left);
  const rightBuffer = Buffer.from(right);
  if (leftBuffer.length !== rightBuffer.length) return false;
  return timingSafeEqual(leftBuffer, rightBuffer);
}

function bearerToken(request: Request) {
  const authorization = request.headers.get("authorization") || "";
  const match = authorization.match(/^Bearer\s+(.+)$/i);
  return match?.[1]?.trim() || "";
}

export function isPascalInternalRequest(request: Request) {
  const expected = String(process.env.PASCAL_PROXY_SECRET || "").trim();
  if (!expected) return false;
  const supplied =
    request.headers.get(PASCAL_INTERNAL_SECRET_HEADER)?.trim() ||
    bearerToken(request);
  return Boolean(supplied) && safeEqual(supplied, expected);
}