import { hmac as nobleHmac } from "@noble/hashes/hmac";
import { sha1 } from "@noble/hashes/sha1";
import { hmac as suaveplanHmac } from "@suaveplan/crypto-hash";
import type { HotpAlgorithm } from "./hotp.types.js";

/**
 * Compute HMAC over `data` keyed by `key` using one of the algorithms RFC 6238
 * §1.2 permits for OTP. SHA-256 and SHA-512 route through `@suaveplan/crypto-hash`
 * (the canonical HMAC façade); SHA-1 routes through `@noble/hashes/sha1`
 * directly because crypto-hash does not expose SHA-1 (it is RFC-mandated for
 * OTP backwards-compat ONLY and must not be presented as a general-purpose
 * choice elsewhere in the platform).
 */
export function hmacFor(
    algorithm: HotpAlgorithm,
    key: Uint8Array,
    data: Uint8Array
): Uint8Array {
    if (algorithm === "SHA1") {
        return nobleHmac(sha1, key, data);
    }
    if (algorithm === "SHA256") {
        return suaveplanHmac("SHA-256", key, data);
    }
    return suaveplanHmac("SHA-512", key, data);
}