Vairogs API & MCP

import { randomBytes, createCipheriv } from 'crypto';
import sharp from 'sharp';

// 1. Ģenerē unikālu ID un DEK faila šifrēšanai
const itemId = crypto.randomUUID();
const fileDEK = randomBytes(32);  // 256-bit AES key
const fileIv = randomBytes(12);   // 96-bit IV for GCM
const thumbnailDEK = randomBytes(32);
const thumbnailIv = randomBytes(12);

// 2. Šifrē failu ar AES-256-GCM
const fileCipher = createCipheriv('aes-256-gcm', fileDEK, fileIv);
const encryptedFile = Buffer.concat([
  fileCipher.update(originalFileBuffer),
  fileCipher.final(),
  fileCipher.getAuthTag()  // GCM auth tag (16 bytes)
]);

// 3. Ģenerē un šifrē thumbnail (tikai attēliem)
const THUMBNAIL_SIZE = 200;
const thumbnailBuffer = await sharp(originalFileBuffer)
  .resize(THUMBNAIL_SIZE, THUMBNAIL_SIZE, {
    fit: 'inside',
    withoutEnlargement: true
  })
  .rotate()  // Auto-rotate based on EXIF
  .jpeg({ quality: 70, mozjpeg: true })
  .toBuffer();

const thumbCipher = createCipheriv('aes-256-gcm', thumbnailDEK, thumbnailIv);
const encryptedThumbnail = Buffer.concat([
  thumbCipher.update(thumbnailBuffer),
  thumbCipher.final(),
  thumbCipher.getAuthTag()
]);

// 4. Pieprasīt parakstītus upload URL
const uploadRes = await fetch('https://vairogs.lv/api/v2/tag/files/upload', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': ACCESS_KEY  // vgtk_a_...
  },
  body: JSON.stringify({
    itemId,
    fileType: 'image',
    fileSize: encryptedFile.length,
    thumbnailSize: encryptedThumbnail.length
  })
});

const { data: urls } = await uploadRes.json();

// 5. Augšupielādēt failu uz Supabase (tiešs PUT)
await fetch(urls.fileUploadUrl, {
  method: 'PUT',
  body: encryptedFile,
  headers: { 'Content-Type': 'application/octet-stream' }
});

// 6. Augšupielādēt thumbnail
await fetch(urls.thumbnailUploadUrl, {
  method: 'PUT',
  body: encryptedThumbnail,
  headers: { 'Content-Type': 'application/octet-stream' }
});

// 7. Apstiprināt augšupielādi
await fetch('https://vairogs.lv/api/v2/tag/files/confirm', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': ACCESS_KEY
  },
  body: JSON.stringify({
    itemId,
    fileSize: encryptedFile.length,
    thumbnailSize: encryptedThumbnail.length
  })
});

// 8. Izveidot item ar fileMetadata (SVARĪGI: iekļaut DEK!)
const itemData = {
  fileMetadata: {
    storagePath: urls.filePath,
    thumbnailPath: urls.thumbnailPath,
    originalFileName: 'photo.jpg',
    mimeType: 'image/jpeg',
    fileSize: originalFileBuffer.length,
    encryptedSize: encryptedFile.length,
    fileIv: fileIv.toString('base64'),
    thumbnailIv: thumbnailIv.toString('base64'),
    fileDEK: fileDEK.toString('base64'),        // OBLIGĀTI MCP failiem!
    thumbnailDEK: thumbnailDEK.toString('base64')
  },
  notes: 'Augšupielādēts caur MCP'
};

// 9. Šifrē metadata un izveido item (sk. Write operāciju piemērus)
// ... (DEK ģenerācija, key slots izveidošana, POST /api/v2/tag/items)