package configread

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
)

// TaskConfigurationSHA256 protects selection-to-originate freshness without
// treating SaaS revision/status metadata as immutable business configuration.
func TaskConfigurationSHA256(task Task) (string, error) {
	decoder := json.NewDecoder(bytes.NewReader(task.Raw))
	decoder.UseNumber()
	var value map[string]any
	if err := decoder.Decode(&value); err != nil {
		return "", fmt.Errorf("decode selected task configuration: %w", err)
	}
	delete(value, "task_revision")
	delete(value, "status")
	body, err := json.Marshal(value)
	if err != nil {
		return "", fmt.Errorf("encode selected task configuration: %w", err)
	}
	sum := sha256.Sum256(body)
	return hex.EncodeToString(sum[:]), nil
}