package aitools

import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"strings"
)

// ConfirmBindHash 绑定 connection + 规范化语句；改语句则哈希变，须重确认。
func ConfirmBindHash(connectionID, statement string) string {
	connectionID = strings.TrimSpace(connectionID)
	statement = strings.Join(strings.Fields(strings.TrimSpace(statement)), " ")
	sum := sha256.Sum256([]byte(connectionID + "\n" + statement))
	return hex.EncodeToString(sum[:])
}

// Agent 写操作还绑定数据库，避免确认时切换到同连接的其他库。
func ConfirmAgentBindHash(connectionID, database, statement string) string {
	return ConfirmBindHash(connectionID, strings.TrimSpace(database)+"\n"+statement)
}

func VerifyAgentBind(connectionID, database, statement, bind string) error {
	if strings.TrimSpace(bind) == "" || !strings.EqualFold(bind, ConfirmAgentBindHash(connectionID, database, statement)) {
		return fmt.Errorf("confirmBind mismatch: statement, connection or database changed; re-confirm required")
	}
	return nil
}

// VerifyConfirmBind 校验客户端带回的 bind；空 bind 视为不合法（桌面路径必须带）。
func VerifyConfirmBind(connectionID, statement, bind string) error {
	bind = strings.TrimSpace(bind)
	if bind == "" {
		return fmt.Errorf("confirmBind required")
	}
	want := ConfirmBindHash(connectionID, statement)
	if !strings.EqualFold(bind, want) {
		return fmt.Errorf("confirmBind mismatch: statement or connection changed; re-confirm required")
	}
	return nil
}