package peer

import (
	"encoding/binary"
	"net/netip"

	"golang.org/x/crypto/nacl/sign"
	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
)

func (a *App) onMulticastDiscovery(e MulticastEvent) {
	if a.isPublic {
		return
	}

	// Peek at the VPN IP byte to find the sender peer before verifying.
	// nacl/sign prepends a 64-byte signature, so payload starts at offset sign.Overhead.
	if len(e.signed) != mcSignedBeaconLen {
		return
	}
	netAddr := a.vpnNet.Addr().As4()
	octets := netAddr
	octets[3] = e.signed[sign.Overhead]
	vpnIP := netip.AddrFrom4(octets)

	peer, ok := a.peersByIP[vpnIP]
	if !ok {
		return
	}

	if peer.IsPublic || peer.State() == StateDirect {
		return
	}

	payload, ok := sign.Open(nil, e.signed, &peer.SignPubKey)
	if !ok {
		return
	}

	// payload: [1 VPN IP byte][32 WG pubkey][2 WG port]
	wgPubKey, err := wgtypes.NewKey(payload[1:33])
	if err != nil || wgPubKey != peer.PubKey() {
		return
	}

	wgPort := binary.BigEndian.Uint16(payload[33:35])
	endpoint := netip.AddrPortFrom(e.src, wgPort)
	if !endpoint.IsValid() {
		return
	}

	var v4, v6 netip.AddrPort
	if e.src.Is4() {
		v4 = endpoint
	} else {
		v6 = endpoint
	}

	a.addProbe(peer, v4, v6)
}