import { config } from '../config.js';
import { proxyRequest } from '../services/websocket.js';

// Twilio's Lookup v2 has no IP allow-list requirement today, but every other
// third-party call in this bot (SIW, Google) is already proxied through the
// on-prem agent. Doing the same for Twilio keeps the network surface
// consistent — if Twilio ever adds IP restrictions, or the bot moves behind
// a corporate egress proxy, this call keeps working without a code change.
// `insecure` is not set here: Twilio uses public CAs that Node trusts, and
// the agent's host reaches lookups.twilio.com without an SSL-inspecting hop.

function twilioAuthHeaders() {
    const auth = Buffer.from(`${config.twilio.accountSid}:${config.twilio.authToken}`).toString(
        'base64',
    );
    return { Authorization: `Basic ${auth}` };
}

/**
 * Look up a phone number via Twilio's Lookup v2. Returns the raw response
 * body; callers typically use `.phone_number` (E.164 normalized).
 */
export async function validatePhoneNumber(phoneNumber) {
    const url = `https://lookups.twilio.com/v2/PhoneNumbers/${encodeURIComponent(phoneNumber)}`;
    const response = await proxyRequest({
        method: 'GET',
        url,
        headers: twilioAuthHeaders(),
    });
    return response?.data;
}