package license

import (
	"fmt"

	"github.com/hyperboloide/lk"
)

// trustedPublicKeys are the keys a licence may be signed with, newest first.
//
// To rotate: prepend the new key, ship a server release that trusts both, then
// reissue. Remove a retired key only once every licence signed with it has
// expired.
//
// This is a slice from day one even though it holds one entry, because
// retrofitting a single-key verifier into a multi-key one during an incident is
// not a thing to plan for.
//
// These are compiled in and deliberately not configurable. A configurable trust
// root is a licensing bypass: a self-hosted operator could point it at a keypair
// they generated themselves.
var trustedPublicKeys = []string{
	// Populated in Task 6 with the real production key.
	// Until then this slice is empty and every licence fails to verify,
	// which is the correct default for a build with no trust root.
}

func publicKeys() ([]*lk.PublicKey, error) {
	out := make([]*lk.PublicKey, 0, len(trustedPublicKeys))
	for i, s := range trustedPublicKeys {
		k, err := lk.PublicKeyFromB32String(s)
		if err != nil {
			return nil, fmt.Errorf("trusted public key %d is malformed: %w", i, err)
		}
		out = append(out, k)
	}
	return out, nil
}