package license

import (
	"fmt"

	"github.com/hyperboloide/lk"
)

// trustedPublicKeys are the keys a licence may be signed with, newest first.
//
// To rotate: prepend the new key, ship a server release that trusts both, then
// reissue. Remove a retired key only once every licence signed with it has
// expired.
//
// This is a slice from day one even though it holds one entry, because
// retrofitting a single-key verifier into a multi-key one during an incident is
// not a thing to plan for.
//
// These are compiled in and deliberately not configurable. A configurable trust
// root is a licensing bypass: a self-hosted operator could point it at a keypair
// they generated themselves.
var trustedPublicKeys = []string{
	// Production signing key, generated 2026-07-24. Index 0 is current.
	"AS6Z4XBXF7HPTOMBUK47SWHPROAGOSBIW5ZZZHTLCA6FHMYSHCCTV3S6AIN6DOB6VKMHMTLRIWPSBAZ2FOHJV3A6NLOCWGEO2VA7KYGSG62SILEFA4SNJ7VWDDIVZZM4ZU4VJVE22LESH72STAAVIDYI77WA====",
}

func publicKeys() ([]*lk.PublicKey, error) {
	out := make([]*lk.PublicKey, 0, len(trustedPublicKeys))
	for i, s := range trustedPublicKeys {
		k, err := lk.PublicKeyFromB32String(s)
		if err != nil {
			return nil, fmt.Errorf("trusted public key %d is malformed: %w", i, err)
		}
		out = append(out, k)
	}
	return out, nil
}