package snapshotwire

import (
	"crypto/sha256"
	"errors"
	"fmt"

	controlplanev1 "proxy-pool/gen/controlplane/v1"

	"google.golang.org/protobuf/proto"
)

var ErrNilSnapshot = errors.New("nil worker snapshot")

// Checksum is the canonical wire checksum for a full snapshot. The checksum
// field itself is excluded so both Controller and Gateway can verify it.
func Checksum(full *controlplanev1.WorkerSnapshot) ([sha256.Size]byte, error) {
	if full == nil {
		return [sha256.Size]byte{}, ErrNilSnapshot
	}
	copy := proto.Clone(full).(*controlplanev1.WorkerSnapshot)
	copy.Checksum = nil
	encoded, err := proto.MarshalOptions{Deterministic: true}.Marshal(copy)
	if err != nil {
		return [sha256.Size]byte{}, fmt.Errorf("marshal worker snapshot: %w", err)
	}
	return sha256.Sum256(encoded), nil
}