package main

import (
    "context"
    "log"
    "time"

    "github.com/arrorLabArts/auroprint-go"
)

func main() {
    ctx := context.Background()

    // Request from Flutter client
    req := auroprint.Request{
        Payload:          `{"did":"device123","ts":1700000000,"nonce":"abc123"}`,
        Signature:        "base64signature...",
        PublicKey:        "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----",
        AttestationChain: []string{"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"},
        IntegrityToken:   "optional-play-integrity-token",
    }

    // Verify the request
    result := auroprint.Verify(ctx, req, &auroprint.VerifyOptions{
        PlayIntegrityPackageName: "com.yourapp.package",
    })

    if !result.Valid {
        log.Fatal("Verification failed:", result.Error)
    }

    // Use the verified payload
    deviceID := result.Payload.DeviceID
    nonce := result.Payload.Nonce
    timestamp := result.Payload.Timestamp

    // Application-specific anti-replay checks
    if time.Now().Unix()-timestamp > 30 {
        log.Fatal("Request expired")
    }

    // Check nonce against your store (Redis, database, etc.)
    // ...

    log.Printf("Verified device: %s, nonce: %s", deviceID, nonce)
}

opts := &auroprint.VerifyOptions{
    // Skip attestation chain verification
    SkipAttestationVerification: false,

    // Required if using Play Integrity
    PlayIntegrityPackageName: "com.yourapp.package",

    // Service account credentials for Play Integrity API
    // If empty, uses default credentials
    GoogleCredentialsJSON: []byte(`{...}`),

    // Optional: Expected nonce for Play Integrity token
    // If set, validates token nonce matches (prevents replay attacks)
    PlayIntegrityExpectedNonce: "server-generated-nonce-123",

    // Optional: Maximum age in seconds for Play Integrity token
    // If > 0, validates token timestamp is within this window
    // Recommended: 60 seconds
    PlayIntegrityMaxAgeSeconds: 60,
}

import (
    "context"
    "crypto/rand"
    "encoding/base64"
)

// 1. Generate a unique nonce for this request
func generateNonce() string {
    b := make([]byte, 32)
    rand.Read(b)
    return base64.URLEncoding.EncodeToString(b)
}

func handleRequest(ctx context.Context, req auroprint.Request) {
    // 2. Generate nonce (you should have sent this to client earlier)
    expectedNonce := generateNonce()
    // In practice, send this to client first, client includes it in Play Integrity request

    // 3. Verify with anti-replay protection
    result := auroprint.Verify(ctx, req, &auroprint.VerifyOptions{
        PlayIntegrityPackageName:   "com.yourapp.package",
        PlayIntegrityExpectedNonce: expectedNonce,
        PlayIntegrityMaxAgeSeconds: 60, // Token must be < 60 seconds old
    })

    if !result.Valid {
        log.Printf("Verification failed: %v", result.Error)
        return
    }

    // 4. Optional: Track used tokens to prevent duplicate use
    // trackUsedToken(req.IntegrityToken)

    log.Printf("Verified device: %s", result.Payload.DeviceID)
}