## Pure-Nim SHA-256, HMAC-SHA256 and HKDF-SHA256.
##
## No dependencies: the avatar seed has to be derivable anywhere the port runs,
## including builds with no OpenSSL to bind against.

import std/strutils

type Sha256Digest* = array[32, byte]

const K: array[64, uint32] = [
  0x428a2f98'u32, 0x71374491'u32, 0xb5c0fbcf'u32, 0xe9b5dba5'u32,
  0x3956c25b'u32, 0x59f111f1'u32, 0x923f82a4'u32, 0xab1c5ed5'u32,
  0xd807aa98'u32, 0x12835b01'u32, 0x243185be'u32, 0x550c7dc3'u32,
  0x72be5d74'u32, 0x80deb1fe'u32, 0x9bdc06a7'u32, 0xc19bf174'u32,
  0xe49b69c1'u32, 0xefbe4786'u32, 0x0fc19dc6'u32, 0x240ca1cc'u32,
  0x2de92c6f'u32, 0x4a7484aa'u32, 0x5cb0a9dc'u32, 0x76f988da'u32,
  0x983e5152'u32, 0xa831c66d'u32, 0xb00327c8'u32, 0xbf597fc7'u32,
  0xc6e00bf3'u32, 0xd5a79147'u32, 0x06ca6351'u32, 0x14292967'u32,
  0x27b70a85'u32, 0x2e1b2138'u32, 0x4d2c6dfc'u32, 0x53380d13'u32,
  0x650a7354'u32, 0x766a0abb'u32, 0x81c2c92e'u32, 0x92722c85'u32,
  0xa2bfe8a1'u32, 0xa81a664b'u32, 0xc24b8b70'u32, 0xc76c51a3'u32,
  0xd192e819'u32, 0xd6990624'u32, 0xf40e3585'u32, 0x106aa070'u32,
  0x19a4c116'u32, 0x1e376c08'u32, 0x2748774c'u32, 0x34b0bcb5'u32,
  0x391c0cb3'u32, 0x4ed8aa4a'u32, 0x5b9cca4f'u32, 0x682e6ff3'u32,
  0x748f82ee'u32, 0x78a5636f'u32, 0x84c87814'u32, 0x8cc70208'u32,
  0x90befffa'u32, 0xa4506ceb'u32, 0xbef9a3f7'u32, 0xc67178f2'u32]

const H0: array[8, uint32] = [
  0x6a09e667'u32, 0xbb67ae85'u32, 0x3c6ef372'u32, 0xa54ff53a'u32,
  0x510e527f'u32, 0x9b05688c'u32, 0x1f83d9ab'u32, 0x5be0cd19'u32]

func rotr(x: uint32, n: int): uint32 {.inline.} =
  (x shr n) or (x shl (32 - n))

func toBytes*(s: string): seq[byte] =
  ## UTF-8 bytes of a string.
  result = newSeq[byte](s.len)
  for i, c in s:
    result[i] = byte(c)

func digest*(input: openArray[byte]): Sha256Digest =
  let
    n = input.len
    bitlen = uint64(n) * 8
    blocks = (n + 9 + 63) div 64
  var padded = newSeq[byte](blocks * 64)
  for i, b in input:
    padded[i] = b
  padded[n] = 0x80
  for i in 0 ..< 8:
    padded[padded.len - 1 - i] = byte((bitlen shr (8 * i)) and 0xff)

  var h = H0
  var w: array[64, uint32]
  for blk in 0 ..< blocks:
    let off = blk * 64
    for i in 0 ..< 16:
      w[i] = (uint32(padded[off + i*4]) shl 24) or
             (uint32(padded[off + i*4 + 1]) shl 16) or
             (uint32(padded[off + i*4 + 2]) shl 8) or
              uint32(padded[off + i*4 + 3])
    for i in 16 ..< 64:
      let
        w15 = w[i - 15]
        w2 = w[i - 2]
        s0 = rotr(w15, 7) xor rotr(w15, 18) xor (w15 shr 3)
        s1 = rotr(w2, 17) xor rotr(w2, 19) xor (w2 shr 10)
      w[i] = w[i - 16] + s0 + w[i - 7] + s1

    var (a, b, c, d, e, f, g, hh) = (h[0], h[1], h[2], h[3], h[4], h[5], h[6], h[7])
    for i in 0 ..< 64:
      let
        s1 = rotr(e, 6) xor rotr(e, 11) xor rotr(e, 25)
        ch = (e and f) xor ((not e) and g)
        t1 = hh + s1 + ch + K[i] + w[i]
        s0 = rotr(a, 2) xor rotr(a, 13) xor rotr(a, 22)
        maj = (a and b) xor (a and c) xor (b and c)
        t2 = s0 + maj
      hh = g; g = f; f = e; e = d + t1
      d = c; c = b; b = a; a = t1 + t2

    for i, v in [a, b, c, d, e, f, g, hh]:
      h[i] = h[i] + v

  for i, v in h:
    result[i*4] = byte((v shr 24) and 0xff)
    result[i*4 + 1] = byte((v shr 16) and 0xff)
    result[i*4 + 2] = byte((v shr 8) and 0xff)
    result[i*4 + 3] = byte(v and 0xff)

func digest*(s: string): Sha256Digest = digest(toBytes(s))

func hmac*(key, msg: openArray[byte]): Sha256Digest =
  ## HMAC-SHA256.
  var k = @key
  if k.len > 64:
    k = @(digest(k))
  var ipad, opad = newSeq[byte](64)
  for i in 0 ..< 64:
    let kb = if i < k.len: k[i] else: 0'u8
    ipad[i] = kb xor 0x36
    opad[i] = kb xor 0x5c
  let inner = digest(ipad & @msg)
  digest(opad & @inner)

func hmac*(key, msg: string): Sha256Digest = hmac(toBytes(key), toBytes(msg))

func hkdf*(ikm, salt, info: openArray[byte], length = 32): seq[byte] =
  ## HKDF-SHA256 (extract + expand). One expand block, so `length` <= 32.
  doAssert length <= 32, "hkdf: only one expand block is implemented"
  let prk = hmac(salt, ikm)
  let t1 = hmac(prk, @info & @[1'u8])
  result = @(t1)
  result.setLen(length)

func hkdf*(ikm, salt, info: string, length = 32): seq[byte] =
  hkdf(toBytes(ikm), toBytes(salt), toBytes(info), length)

func toHex*(bs: openArray[byte]): string =
  ## Lowercase hex.
  result = newStringOfCap(bs.len * 2)
  for b in bs:
    result.add toHex(int(b), 2).toLowerAscii