voicecode.go

// Copyright 2017-2026 Allow2 Pty Ltd. All rights reserved.
// Use of this source code is governed by the Allow2 API and SDK Licence.

package allow2service

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"math/rand"
	"strconv"
	"strings"
	"time"
)

// GenerateVoiceChallenge generates an offline voice code challenge-response pair.
//
// Challenge format: T A MM NN
//
//	T  = Request type (0 = more time, 1 = day type change, 2 = ban lift)
//	A  = Activity ID (0-99)
//	MM = Minutes in 5-minute increments (0-99, so 0-495 minutes)
//	NN = Random nonce (0-99)
//
// Response: First 6 digits of HMAC-SHA256(secret, challenge + date)
// Date-bound: expires at midnight in the child's timezone.
//
// Pass an empty string for date to use today's date.
func GenerateVoiceChallenge(secret string, reqType RequestType, activityID, minutes int, date string) (*VoiceCodePair, error) {
	if date == "" {
		date = time.Now().Format("2006-01-02")
	}

	// T: request type code (0-2)
	t := reqType.VoiceCode()

	// A: activity ID clamped to 0-99
	a := activityID
	if a < 0 {
		a = 0
	}
	if a > 99 {
		a = 99
	}

	// MM: minutes in 5-minute increments, clamped to 0-99
	mm := int(float64(minutes)/5.0 + 0.5)
	if mm < 0 {
		mm = 0
	}
	if mm > 99 {
		mm = 99
	}

	// NN: random nonce 0-99
	nn := rand.Intn(100)

	challenge := fmt.Sprintf("%d %02d %02d %02d", t, a, mm, nn)
	expectedResponse := computeResponse(secret, challenge, date)

	return &VoiceCodePair{
		Challenge:        challenge,
		ExpectedResponse: expectedResponse,
	}, nil
}

// VerifyVoiceResponse verifies a voice code response against a challenge.
// Pass an empty string for date to use today's date.
func VerifyVoiceResponse(secret, challenge, response, date string) bool {
	if date == "" {
		date = time.Now().Format("2006-01-02")
	}
	expected := computeResponse(secret, challenge, date)

	// Constant-time comparison
	return hmac.Equal([]byte(expected), []byte(response))
}

// DecodeChallenge decodes a challenge string into its component parts.
// Returns nil if the format is invalid.
func DecodeChallenge(challenge string) *DecodedChallenge {
	parts := strings.Fields(strings.TrimSpace(challenge))
	if len(parts) != 4 {
		return nil
	}

	typeCode, err := strconv.Atoi(parts[0])
	if err != nil {
		return nil
	}

	activityID, err := strconv.Atoi(parts[1])
	if err != nil {
		return nil
	}

	minuteIncrements, err := strconv.Atoi(parts[2])
	if err != nil {
		return nil
	}

	nonce, err := strconv.Atoi(parts[3])
	if err != nil {
		return nil
	}

	return &DecodedChallenge{
		Type:       typeCode,
		ActivityID: activityID,
		Minutes:    minuteIncrements * 5,
		Nonce:      nonce,
	}
}

// DecodedChallenge represents the parsed components of a voice code challenge.
type DecodedChallenge struct {
	Type       int
	ActivityID int
	Minutes    int
	Nonce      int
}

// computeResponse computes the 6-digit response for a challenge + date.
func computeResponse(secret, challenge, date string) string {
	message := challenge + date
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(message))
	hmacHex := hex.EncodeToString(mac.Sum(nil))

	// Take first 8 hex chars, convert to integer, modulo 1,000,000 for 6 digits
	hex8 := hmacHex[:8]
	truncated, _ := strconv.ParseUint(hex8, 16, 64)
	code := truncated % 1000000

	return fmt.Sprintf("%06d", code)
}