"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.verifyAKP = verifyAKP;
const cose_js_1 = require("../../cose.js");
const index_js_1 = require("../../index.js");
const importJWKKey_js_1 = require("./importJWKKey.js");
const getWebCrypto_js_1 = require("./getWebCrypto.js");
const mapCoseAlgToWebCryptoKeyAlgName_js_1 = require("./mapCoseAlgToWebCryptoKeyAlgName.js");
const index_js_2 = require("../../../errors/index.js");
/** AKP, a.k.a ML-DSA */
async function verifyAKP(opts) {
    const { cosePublicKey, signature, data } = opts;
    const WebCrypto = await (0, getWebCrypto_js_1.getWebCrypto)();
    const alg = cosePublicKey.get(cose_js_1.COSEKEYS.alg);
    const pub = cosePublicKey.get(cose_js_1.COSEKEYS.pub);
    if (!alg) {
        throw new Error('Public key was missing alg (AKP)');
    }
    if (!(0, cose_js_1.isCOSEAlg)(alg)) {
        throw new Error(`Public key had invalid alg ${alg} (AKP)`);
    }
    if (!pub) {
        throw new Error('Public key was missing pub (AKP)');
    }
    const webCryptoAlg = (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg);
    // See https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-operations-import-key -> "jwk"
    const keyData = {
        kty: 'AKP',
        alg: webCryptoAlg,
        pub: index_js_1.isoBase64URL.fromBuffer(pub),
        ext: false,
    };
    /**
     * ML-DSA support is pretty cutting edge, so take some steps to help RP's understand this instead
     * of them getting a `NotSupportedError: Unrecognized algorithm name` and trying to interpret it.
     */
    let key;
    try {
        key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: webCryptoAlg });
    }
    catch (err) {
        const _err = err;
        if (_err.name === 'NotSupportedError') {
            throw new index_js_2.PQCNotSupportedError(alg);
        }
        else {
            throw err;
        }
    }
    return WebCrypto.subtle.verify(webCryptoAlg, key, signature, data);
}