package bind

import (
	"crypto/rand"
	"encoding/base64"
	"fmt"
)

// GenerateSecret returns a base64-encoded cryptographically-random key of n
// bytes, suitable for a TSIG or rndc HMAC secret.
func GenerateSecret(n int) (string, error) {
	buf := make([]byte, n)
	if _, err := rand.Read(buf); err != nil {
		return "", fmt.Errorf("read random: %w", err)
	}
	return base64.StdEncoding.EncodeToString(buf), nil
}

// KeyClause renders a named.conf `key` block for inclusion.
func KeyClause(name, algorithm, secret string) string {
	return fmt.Sprintf("key \"%s\" {\n    algorithm %s;\n    secret \"%s\";\n};\n", name, algorithm, secret)
}

// SecretBytesForAlgorithm returns a reasonable key length for a TSIG algorithm.
func SecretBytesForAlgorithm(algorithm string) int {
	switch algorithm {
	case "hmac-sha512", "hmac-sha384":
		return 64
	case "hmac-sha256":
		return 32
	default:
		return 32
	}
}