export default {
  async fetch(request, env) {
    const auth = request.headers.get("Authorization") ?? "";
    if (auth.startsWith("Basic ")) {
      let ok = false;
      try {
        const decoded = atob(auth.slice(6));
        const password = decoded.slice(decoded.indexOf(":") + 1); // password may contain ':'
        ok = await passwordMatches(password, env.SITE_PASSWORD);
      } catch {}
      if (ok) return env.ASSETS.fetch(request);
    }
    return new Response("Authentication required", {
      status: 401,
      headers: { "WWW-Authenticate": 'Basic realm="leetcode-docs", charset="UTF-8"' },
    });
  },
};

// timingSafeEqual needs equal-length buffers → hash both sides first
async function passwordMatches(candidate, expected) {
  const enc = new TextEncoder();
  const [a, b] = await Promise.all([
    crypto.subtle.digest("SHA-256", enc.encode(candidate)),
    crypto.subtle.digest("SHA-256", enc.encode(expected)),
  ]);
  return crypto.subtle.timingSafeEqual(a, b);
}