// Package kept holds what the layouts of the Delivery domain's kept values share: the reading of one at its version and the form
// of a digest. It names no seat and no module (ADR 0634 §2). The version (keys.Version, keys.CheckVersion), the rule a name
// must keep to be a key part (keys.CheckName), keys.IsHex64 and the escaping of a name (keys.EscapeName) are mesh-sdk's,
// since more than one domain uses them.
package kept

import (
	"encoding/json"
	"fmt"
	"regexp"

	"git.novox.be/novox/mesh-sdk/go/keys"
)

// Decode reads data into into after CheckVersion.
func Decode(data []byte, into any) error {
	if err := keys.CheckVersion(data); err != nil {
		return err
	}
	if err := json.Unmarshal(data, into); err != nil {
		return fmt.Errorf("kept: value does not fit its shape: %w", err)
	}
	return nil
}

var digestForm = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)

// CheckDigest refuses a digest that is not sha256:<64 lowercase hex digits>, saying what it is of.
func CheckDigest(digest, of string) error {
	if !digestForm.MatchString(digest) {
		return fmt.Errorf("kept: %s %q is not sha256:<64 lowercase hex digits>", of, digest)
	}
	return nil
}