import { verify } from '~/helpers/signature'
import { DeviceCommandBody } from '../schema'

export default abstract class CommandService {
  static async sendCommand(body: DeviceCommandBody, headers: Record<string, string | undefined>): Promise<{
    status: 'success'
    message: 'Command accepted'
    receivedAt: string
  }> {
    const apiKey = headers['x-api-key']
    if (!apiKey) {
      throw new Error('invalid_api_key')
    }

    // For now, use apiKey as secretKey since DB validation is skipped
    const secretKey = apiKey

    // Remove signature from body for verification
    const { signature, ...bodyWithoutSignature } = body

    const isValid = verify(bodyWithoutSignature, signature, secretKey)
    if (!isValid) {
      throw new Error('invalid_signature')
    }

    // TODO: Check nonce for replay attack when DB is implemented

    return {
      status: 'success',
      message: 'Command accepted',
      receivedAt: new Date().toISOString(),
    }
  }
}