package recordlocks

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"strings"
)

const parentLaneHashPrefix = "parent-lane:v1\x00"

// CanonicalParentLaneKey returns the stable parent-lane key used for durable
// admission. Object names are case-insensitive; record IDs remain exact.
func CanonicalParentLaneKey(key ParentKey) (ParentKey, bool) {
	key, ok := NormalizeParentKey(key)
	if !ok {
		return ParentKey{}, false
	}
	key.ObjectName = strings.ToLower(key.ObjectName)
	return key, true
}

// ParentLaneKeyHash returns the SHA-256 hex key used as the durable lane row
// identity. The hash includes a versioned domain prefix so future canonical-key
// changes cannot collide with v1 rows.
func ParentLaneKeyHash(key ParentKey) (string, bool) {
	key, ok := CanonicalParentLaneKey(key)
	if !ok {
		return "", false
	}
	sum := sha256.Sum256([]byte(parentLaneHashPrefix + KeyID(key)))
	return hex.EncodeToString(sum[:]), true
}

// NewParentLaneOwnerToken creates an opaque fencing token for one lane owner.
func NewParentLaneOwnerToken() (string, error) {
	var token [16]byte
	if _, err := rand.Read(token[:]); err != nil {
		return "", err
	}
	return hex.EncodeToString(token[:]), nil
}