package auth

import (
	"crypto/rand"
	"encoding/hex"
	"errors"
	"strings"

	"github.com/emmansun/gmsm/sm2"
	"github.com/emmansun/gmsm/sm3"
)

// SignSM2Authorization signs `message` with the SM2 private key in hex form
// (mirroring the Zhanlu plugin: SM3 digest signed with hash:false, der:false,
// output as 64-byte r||s hex).
func SignSM2Authorization(privateKeyHex, message string) (string, error) {
	keyHex := strings.TrimPrefix(strings.TrimSpace(privateKeyHex), "0x")
	keyBytes, err := hex.DecodeString(keyHex)
	if err != nil {
		return "", err
	}
	priv, err := sm2.NewPrivateKey(keyBytes)
	if err != nil {
		return "", err
	}
	digest := sm3.Sum([]byte(message))
	r, s, err := sm2.Sign(rand.Reader, &priv.PrivateKey, digest[:])
	if err != nil {
		return "", err
	}
	rb := r.FillBytes(make([]byte, 32))
	sb := s.FillBytes(make([]byte, 32))
	return hex.EncodeToString(append(rb, sb...)), nil
}

var errEmptySM2Key = errors.New("SM2 private key is required")