
// proofProviderKeys provides functions to derive payment proof provider account keys
// Account keys is a public/private key pair which is used to manage a user's account with a payment proof provider
// We derive keys from our seed phrase so that funds can be recovered from a user's seed phrase

package proofProviderKeys

// A user's account private key is required to check their payment proof provider account balance, spend funds, and deposit funds
// Each payment proof provider has a public key
// We combine their public key with the network type and randomness derived from our seed phrase to derive a public/private key pair

import "seekia/internal/cryptography/blake3"
import "seekia/internal/cryptography/edwardsKeys"
import "seekia/internal/helpers"

import "slices"
import "errors"


//	When restoring our seed phrase on a new device, we need to try our credentials with all of the available payment proof providers and
//		keysIndexes until we find an account with a balance on it.
//		If we find multiple accounts with balances, we should be able to use multiple accounts at the same time  
// Inputs:
//	-[32]byte: User seed phrase hash
//	-byte: Network type
//	-[32]byte: Payment proof provider public key
//		-Only provide a public key to this function if the server has proven ownership of that key
//		-Two servers could collude and use the same public key, which would cause us to use the same credentials with both servers.
//		-If we used the same public/private key pair with multiple servers, those servers would know that we are the same entity.
//		-This isn't actually a big issue, because if the server is malicious, they can track our behavior on a single server easily anyways
//		-It could give us a false sense of security if we think we have switched to a
//			different server and reset our identity but we actually haven't
//	-byte: Keys index
//		-This index allows us to create multiple different credentials for the same payment proof provider
//		-We will probably never need to do this, unless we want a privacy reset.
//Outputs:
//	-[32]byte: Public key
//	-[64]byte: Private key
//	-error
func GetProofProviderAccountPublicPrivateKeys(seedPhraseHash [32]byte, networkType byte, proofProviderPublicKey [32]byte, keysIndex byte)([32]byte, [64]byte, error){

	isValid := helpers.VerifyNetworkType(networkType)
	if (isValid == false){
		networkTypeString := helpers.ConvertByteToString(networkType)
		return [32]byte{}, [64]byte{}, errors.New("GetProofProviderAccountPublicPrivateKeys called with invalid networkType: " + networkTypeString)
	}

	// This sequence of bytes is the string "prooffundsaccountkeysalt" decoded from base32 to bytes
	saltBytes := []byte{124, 92, 226, 150, 141, 28, 128, 33, 58, 141, 154, 137, 137, 1, 115}

	hashInput := slices.Concat(seedPhraseHash[:], saltBytes)

	hashInput = append(hashInput, networkType)
	hashInput = append(hashInput, proofProviderPublicKey[:]...)
	hashInput = append(hashInput, keysIndex)

	seedBytes, err := blake3.Get32ByteBlake3Hash(hashInput)
	if (err != nil) { return [32]byte{}, [64]byte{}, err }

	publicKeyArray, privateKeyArray := edwardsKeys.GetSeededEdwardsPublicAndPrivateKeys(seedBytes)

	return publicKeyArray, privateKeyArray, nil
}


