import {
  produceBlindRsaWwwAuthenticateHeader,
  redeemPatAuthorizationHeader,
} from '@exact-realty/privacypass';

/**
 * Put method for a KV store
 * @param {ArrayBuffer} key Key
 * @param {string} value Value
 * @returns {Promise<void> | void} Response
 */
const transientStorePut = (key, value) => {
  // KV store
  // ...
};

/**
 * Retrieve method for a KV store
 * @param {ArrayBuffer} key Key
 * @returns {Promise<string> | string} Value
 */
const transientStoreGet = (key: ArrayBuffer) => {
  // KV store
  // ...
};

/**
 * Delete method for a KV store
 * @param {ArrayBuffer} key Key
 * @returns {Promise<void> | void} Response
 */
const transientStoreDelete = (key, value) => {
  // KV store
  // ...
};

/**
 * Your request handler
 * @param {Request} req Incoming request
 * @returns {Response} Response
 */
const requestHandler = async (req) => {
  // If the request has an authorization header, validate the header and, if
  // successful, return some restricted content
  if (req.headers.has('authorization')) {
    const redemptionResult = redeemPatAuthorizationHeader(
      // REQUIRED. A string containing the HTTP authorization header
      req.headers.get('authorization'),
      // REQUIRED. KV-store function. Used to retrieve issued tokens.
      transientStoreGet,
      // REQUIRED. KV-store function. Used to remove spent tokens.
      transientStoreDelete,
    );

    if (redemptionResult) {
      // The token has been 
      return new Response('Hello, World!', {
        headers: [['content-type', 'text/plain']],
      });
    }
  }

  // If no authorization header was present or validation failed, issue a
  // challenge
  const wwwAuthenticate = produceBlindRsaWwwAuthenticateHeader(
    // REQUIRED. Hostname of the issuer.
    // Example: 'demo-pat.issuer.cloudflare.com'
    'issuer',
    // REQUIRED. Hostname of your server, or empty.
    // Example: 'example.com'
    'origin',
    // REQUIRED. KV-store function. Used to remember issued challenges and
    // lookup the verification key
    transientStorePut,
    // OPTIONAL. Array buffer for the redemption context. If provided it must be
    // an `ArrayBuffer` of length 0 or 32. Defaults to a random value.
    undefined,
    // OPTIONAL. `fetch` implementation to retrieve information about the
    // issuer. Defaults to `fetch`.
    fetch,
  );

  if (!wwwAuthenticate) {
    throw new Error('Error producing blind RSA token');
  }

  return new Response(null, {
    headers: [
        ['www-authenticate', produceBlindRsaWwwAuthenticateHeader],
    ],
  });
}