import crypto from 'crypto';

const baseUrl = process.env.CLOUDFRONT_URL!;
const keyPairId = process.env.CLOUDFRONT_KEY_PAIR_ID!;
const privateKeyB64 = process.env.CLOUDFRONT_PRIVATE_KEY_BASE64!;
const ttl = parseInt(process.env.SIGNED_URL_TTL_SECONDS || '120', 10);

function urlSafeBase64(input: Buffer) {
  return input.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
}

export function signUrl(hlsKey: string) {
  const resourceUrl = `${baseUrl.replace(/\/$/, '')}/${hlsKey.replace(/^\//,'')}`;
  const expires = Math.floor(Date.now()/1000) + ttl;

  const policy = Buffer.from(JSON.stringify({
    Statement: [{
      Resource: resourceUrl,
      Condition: { DateLessThan: { 'AWS:EpochTime': expires } }
    }]
  }));

  const signer = crypto.createSign('RSA-SHA1'); // CloudFront uses SHA1 for legacy signed URLs
  signer.update(policy);
  const privateKey = Buffer.from(privateKeyB64, 'base64').toString('utf-8');
  const signature = signer.sign(privateKey);

  const query = new URLSearchParams({
    Policy: urlSafeBase64(policy),
    Signature: urlSafeBase64(signature),
    'Key-Pair-Id': keyPairId,
  });

  return `${resourceUrl}?${query.toString()}`;
}