import os
import time
import json
import hmac
import hashlib

def _load_key() -> bytes:
    raw = os.environ.get("GIO_CORE_SECRET")
    if not raw or not raw.strip():
        raise RuntimeError("GIO_CORE_SECRET missing/empty — refusing to start")
    return raw.strip().encode("utf-8")

CORE_SECRET = _load_key()
KEY_ID = os.environ.get("GIO_CORE_KEY_ID", "v1").strip()

def canonical_jcs(state: dict) -> bytes:
    return json.dumps(
        state,
        sort_keys=True,
        separators=(",", ":"),
        ensure_ascii=False,
        allow_nan=False,
    ).encode("utf-8")

def sign_payload(state: dict) -> str:
    return hmac.new(CORE_SECRET, canonical_jcs(state), hashlib.sha512).hexdigest()

def verify_payload(state: dict, provided_tag: str, max_skew_seconds: int = 30) -> bool:
    if not isinstance(state, dict) or not isinstance(provided_tag, str):
        return False
    try:
        expected = sign_payload(state)
    except (TypeError, ValueError):
        return False
    if not hmac.compare_digest(expected, provided_tag):
        return False  # Rejeitado imediatamente por falha de autenticação
    ts = state.get("timestamp")
    if not isinstance(ts, int) or isinstance(ts, bool):
        return False
    return abs(int(time.time()) - ts) <= max_skew_seconds