import '../core/failure.dart';
import 'vault.dart';

typedef TrustPrompt =
    Future<bool> Function(String endpoint, String type, String fingerprint);

class HostVerifier {
  final Vault vault;
  HostVerifier(this.vault);
  Future<bool> verify(
    String endpoint,
    String type,
    String fingerprint,
    TrustPrompt prompt,
  ) async {
    if (!RegExp(r'^SHA256:[A-Za-z0-9+/]{43}$').hasMatch(fingerprint)) {
      throw const Failure('hostRejected');
    }
    final epoch = vault.generation;
    final previous = vault.fingerprint(endpoint);
    if (previous != null) {
      if (previous != fingerprint) throw const Failure('hostChanged');
      return true;
    }
    if (!await prompt(endpoint, type, fingerprint)) {
      throw const Failure('hostRejected');
    }
    if (epoch != vault.generation) throw const Failure('locked');
    await vault.trust(endpoint, fingerprint);
    return true;
  }
}