// verify.mjs — recompute a 99 Losers draw yourself.
// Node 18 or newer. No dependencies. Run it with:  node verify.mjs
import { createHash, createHmac } from "node:crypto";

// ---- 1. Paste the published values for the cycle, from /verify/<period> -----
const publishedSeedHash = "PASTE_SEED_HASH";    // published when the cycle OPENED
const revealedSeed      = "PASTE_SEED";         // published after the draw ran
const frozenEntriesHash = "PASTE_FROZEN_HASH";  // published when entries CLOSED
const beaconRound       = 0;                    // named when the cycle OPENED
const publishedBeacon   = "PASTE_BEACON";       // that round's value, after close
const beaconSource      = "PASTE_SOURCE";       // "drand" on a real draw
const claimedWinner     = "PASTE_ENTRY_ID";     // the entry we say won

// ---- 2. Paste the frozen entry list from the same page ---------------------
const entries = [
  { ticket: 1, entryId: "ent_...", userId: "usr_..." },
  // ...one row per ticket, exactly as published
];

// ---- 3. The seed must match the commitment made before anyone entered ------
const seedHash = createHash("sha256").update(revealedSeed).digest("hex");
console.log("seed commitment:", seedHash === publishedSeedHash ? "OK" : "MISMATCH");

// ---- 4. The entry list must match the hash published when entries closed ---
// Note what is deliberately absent from these bytes: whether an entry was paid
// for or free. Payment cannot touch the winner, by construction. This check is
// what stops an entry being added, dropped or reordered after the freeze.
const ordered = [...entries].sort((a, b) => a.ticket - b.ticket);
const canonical = ordered
  .map((e) => e.ticket + "|" + e.entryId + "|" + e.userId)
  .join("\n");
const entriesHash = createHash("sha256").update(canonical).digest("hex");
console.log("entry list:     ", entriesHash === frozenEntriesHash ? "OK" : "MISMATCH");
console.log("entries hash:   ", entriesHash);

// ---- 5. The randomness has to come from drand, not from us -----------------
// drand publishes a fresh value every 30 seconds on a fixed public schedule.
// The round above is the one published for this cycle; its value did not exist
// until an hour after entries closed. Fetch it from drand and compare — and if
// you recorded the round number while the cycle was open, compare that too.
const CHAIN = "8990e7a9aaed2ffed73dbd7092123d6f289930540d7651336225dc172e51b2ce";
let beacon = publishedBeacon;
try {
  const url = "https://api.drand.sh/" + CHAIN + "/public/" + beaconRound;
  const res = await fetch(url, { signal: AbortSignal.timeout(10000) });
  if (res.ok) {
    const fetched = (await res.json()).randomness;
    console.log("drand round:    ", fetched === publishedBeacon ? "OK" : "MISMATCH");
    if (beaconSource === "drand") beacon = fetched;  // trust drand, never us
  } else {
    console.log("drand round:     unavailable (HTTP " + res.status + ")");
  }
} catch (error) {
  console.log("drand round:     could not fetch (" + error.message + ")");
}
if (beaconSource !== "drand") {
  console.log("WARNING: beacon source is " + beaconSource + ", not drand — a local");
  console.log("         development stand-in. This draw is NOT independently");
  console.log("         verifiable: no third party holds that value.");
}

// ---- 6. Derive the winning index ------------------------------------------
// HMAC-SHA256 keyed with the seed, over entriesHash:beacon:counter. Rejection
// sampling: any digest at or above the largest exact multiple of n is thrown
// away and the counter bumped, so no ticket is favoured (a plain "digest % n"
// would quietly skew toward low ticket numbers).
const n = BigInt(ordered.length);
const SPACE = 2n ** 256n;
const limit = SPACE - (SPACE % n);
const key = Buffer.from(revealedSeed, "hex");

let index = -1;
for (let counter = 0; counter < 10000; counter += 1) {
  const digest = createHmac("sha256", key)
    .update(entriesHash + ":" + beacon + ":" + counter)
    .digest("hex");
  const value = BigInt("0x" + digest);
  if (value < limit) { index = Number(value % n); break; }  // else re-roll
}

// ---- 7. Compare ------------------------------------------------------------
const winner = ordered[index];
console.log("winning index:  ", index);
console.log("winning entry:  ", winner.entryId);
console.log(
  winner.entryId === claimedWinner
    ? "PASS - the published winner is the one the maths picks"
    : "FAIL - the published winner is not what recomputes",
);