// Signing requests to a partner's API with an RSA key, and a secret encrypted to its public key.
//
//   quillo run rsa.qwe      then open http://localhost:8080/sign

use "rsa.qwer"

// In a real app the private key is a file or a variable: read_file(env("RSA_KEY_FILE")).
let KEYS = rsa_keypair(2048)?

route GET /sign {
    let body = json.stringify({ payment: "pay_77", amount: "120.50", currency: "EUR" })
    let signature = rsa_sign(body, KEYS.private)?
    {
        signature,
        valid: rsa_verify(body, signature, KEYS.public)?,
        tampered: rsa_verify(replace(body, "120.50", "999.00"), signature, KEYS.public)?,
    }
}

route GET /secret {
    let sealed = rsa_encrypt("db password: hunter22", KEYS.public)?
    { sealed, opened: rsa_decrypt(sealed, KEYS.private)?, too_long: rsa_encrypt(repeat("x", 300), KEYS.public).error }
}

route GET /public.pem = respond(200, rsa_public_key(KEYS.private)?, { "content-type": "application/x-pem-file" })