const crypto = require('crypto');

/**
 * Generate HMAC-SHA512 signature in Base64
 * @param {string} message - Comma-separated fields
 * @param {string} secret - Client secret provided by Hamro Pay
 * @returns {string} Base64 encoded signature
 */
function signHMAC(message, secret) {
  try {
    const hmac = crypto.createHmac('sha512', secret);
    hmac.update(message, 'utf8');
    return hmac.digest('base64');
  } catch (error) {
    throw new Error('HMAC signature generation failed: ' + error.message);
  }
}

// Example usage:
const signature = signHMAC("2500.00,NPR,PN_-Nd99TBnAlBjCgl8ef_b,ORD-12345,usr_sec_991823ab", "YOUR_CLIENT_SECRET");
console.log("Signature:", signature);

const params = {
  merchant_id: "Your merchant id",
  session_id: "Session ID",
  token: "Your Token",
  merchant_transaction_id: "ORD-2026-08912", // <= 25 chars
  remarks: "Remarks (upto 250 chars)",
  phone_number: "98XXXXXXXX" // optional
};

const form = document.createElement("form");
form.method = "POST";
form.action = path; // GATEWAY_URL
form.enctype = "application/x-www-form-urlencoded";

for (const key in params) {
  if (params.hasOwnProperty(key)) {
    const hiddenField = document.createElement("input");
    hiddenField.type = "hidden";
    hiddenField.id = key;
    hiddenField.name = key;
    hiddenField.value = params[key];
    form.appendChild(hiddenField);
  }
}

document.body.appendChild(form);
form.submit();

initial_signature_string = merchantTxnId+','+merchantId+','+client_id+','+clientApiKey
final_signature_string = toBase64 ( HmacSHA512DigestOf ( initial_signature_string , using_secret ) )

// Use the following fields from the body, to generate the signature string:
// Seperated by commas
var signatureString = merchantTxnId +','+ merchantId +','+ status +','+ amount;

var signatureFromHeader = header.get("Signature");
var signatureGenFromBodyInBase64 = Base64( HMAC.signHMAC(signatureString , {{merchantWebHookSigningSecret}}) );

var isValid = signatureFromHeader.equals(signatureGenFromBodyInBase64);