import { buildAgentHeaders } from "./server/_core/agentSigning";

// Build signed headers for an outgoing agent-to-agent call
const headers = buildAgentHeaders("agent-host-01", {
  action: "claimWorkItem",
  workItemId: 4821,
});

// headers = {
//   "x-agent-id":        "agent-host-01",
//   "x-agent-timestamp": "1741234567890",
//   "x-agent-signature": "a3f9c2e1...64 hex chars",
// }

await fetch("/api/trpc/system.rotateAgentSecret", {
  method: "POST",
  headers: { ...headers, "Content-Type": "application/json" },
  body: JSON.stringify({ json: { newSecret: undefined } }),
});

// In server/_core/trpc.ts — the middleware runs automatically
// on any procedure declared with agentProcedure

const requireAgentSignature = t.middleware(async ({ ctx, next }) => {
  const { "x-agent-signature": sig, "x-agent-id": agentId,
          "x-agent-timestamp": timestamp } = ctx.req.headers;

  if (!sig || !agentId || !timestamp)
    throw new TRPCError({ code: "UNAUTHORIZED", message: "Missing headers" });

  const body = ctx.req.body ? JSON.stringify(ctx.req.body) : "";
  const payload = JSON.stringify({ agentId, timestamp, body });

  if (!verifyAgentSignature(payload, sig as string))
    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid signature" });

  const age = Date.now() - parseInt(timestamp as string, 10);
  if (age > 30_000 || age < -5_000)
    throw new TRPCError({ code: "UNAUTHORIZED", message: "Timestamp out of window" });

  return next({ ctx: { ...ctx, agentId } });
});

export const agentProcedure = t.procedure.use(requireAgentSignature);

// Rotate the signing secret — callable by any trusted agent
// A new 48-byte random secret is generated if newSecret is omitted

const result = await trpc.system.rotateAgentSecret.mutate(
  { newSecret: undefined }, // auto-generate
  { headers: buildAgentHeaders("agent-host-01", {}) }
);

// result = {
//   success: true,
//   rotatedAt: "2026-03-02T15:43:00.000Z",
//   secretLength: 96,          // 48 bytes → 96 hex chars
//   newSecret: "a3f9c2e1...",  // distribute securely to peer agents
// }

// All signatures made with the OLD secret are now invalid.
// Peer agents must be updated with the new secret before
// they can make further agentProcedure calls.