package layoutroutingsecurityv1

import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
)

// ViewDigest returns the content identity of one complete routing-security
// view. SecurityEpoch is not a view member and therefore cannot affect it.
func ViewDigest(view View) (string, error) {
	canonical, err := CanonicalViewBytes(view)
	if err != nil {
		return "", err
	}
	digest := sha256.Sum256(canonical)
	return "sha256:" + hex.EncodeToString(digest[:]), nil
}

// ValidateBindingForView proves that one independently allocated security
// epoch attests this exact same-org content view.
func ValidateBindingForView(binding Binding, view View) error {
	if err := ValidateBinding(binding); err != nil {
		return err
	}
	if binding.OrgID != view.OrgID {
		return fmt.Errorf("LayoutRoutingSecurityBinding.OrgID does not match view exactly")
	}
	digest, err := ViewDigest(view)
	if err != nil {
		return err
	}
	if binding.LayoutRoutingSecurityViewDigest != digest {
		return fmt.Errorf("LayoutRoutingSecurityBinding digest does not match view")
	}
	return nil
}