Authentication

import axios from "axios";
import crypto from "node:crypto";

const API_KEY    = process.env.FINHAY_API_KEY!;
const API_SECRET = process.env.FINHAY_API_SECRET!;
const BASE_URL   = process.env.FINHAY_BASE_URL ?? "https://open-api.fhsc.com.vn";

const API_KEY_ONLY: RegExp[] = [
  /^\/market\/.*$/,
  /^\/trading\/market\/.*$/,
  /^\/trading\/securities\/.*$/,
  /^\/fund-trading\/public\/.*$/,
];

const isApiKeyOnly = (method: string, path: string): boolean =>
  method === "GET" && API_KEY_ONLY.some((re) => re.test(path));

export const client = axios.create({ baseURL: BASE_URL });

client.interceptors.request.use((config) => {
  const method = (config.method ?? "get").toUpperCase();
  const url    = new URL(config.url ?? "", BASE_URL);
  const path   = url.pathname;

  // Luôn gửi API key.
  config.headers.set("X-FH-APIKEY", API_KEY);

  // Tier 1: market read — dừng ở đây.
  if (isApiKeyOnly(method, path)) return config;

  // Tier 2: HMAC sign request.
  const timestamp = Date.now().toString();
  const nonce     = crypto.randomUUID();
  const query     = url.search.slice(1); // bỏ leading '?'
  const body      = typeof config.data === "string"
    ? config.data
    : config.data != null
      ? JSON.stringify(config.data)
      : "";
  const bodyHash  = body
    ? crypto.createHash("sha256").update(body).digest("hex")
    : "";

  let payload = `${timestamp}\n${method}\n${path}`;
  if (query)    payload += `?${query}`;
  payload += "\n";
  if (bodyHash) payload += bodyHash;

  const signature = crypto
    .createHmac("sha256", API_SECRET)
    .update(payload)
    .digest("hex");

  config.headers.set("X-FH-TIMESTAMP", timestamp);
  config.headers.set("X-FH-NONCE",     nonce);
  config.headers.set("X-FH-SIGNATURE", signature);
  if (bodyHash) config.headers.set("X-FH-BODYHASH", bodyHash);

  // Preview: write ops dưới /trading/oa/** cần thêm 2FA token.
  if (/^\/trading\/oa\//.test(path)) {
    const token = process.env.FINHAY_2FA_TOKEN;
    if (!token) throw new Error("Missing FINHAY_2FA_TOKEN — run OTP flow first");
    config.headers.set("X-FH-2FA-TOKEN", token);
  }

  return config;
});