package com.yau.digitalrmb.security.application;

import com.yau.digitalrmb.security.config.SecurityProperties;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
import org.springframework.security.oauth2.jwt.JwtClaimsSet;
import org.springframework.security.oauth2.jose.jws.MacAlgorithm;
import org.springframework.security.oauth2.jwt.JwsHeader;
import org.springframework.stereotype.Service;

import java.time.Instant;
import java.util.List;
import java.util.Set;

@Service
public class JwtTokenService {
    private final JwtEncoder jwtEncoder;
    private final SecurityProperties properties;

    public JwtTokenService(JwtEncoder jwtEncoder, SecurityProperties properties) {
        this.jwtEncoder = jwtEncoder;
        this.properties = properties;
    }

    public Token issueFor(String username) {
        Instant issuedAt = Instant.now();
        Instant expiresAt = issuedAt.plus(properties.getJwt().getAccessTokenTtl());
        JwtClaimsSet claims = JwtClaimsSet.builder().subject(username).issuedAt(issuedAt).expiresAt(expiresAt)
                .claim("roles", List.of("ROLE_ADMIN")).build();
        Jwt jwt = jwtEncoder.encode(JwtEncoderParameters.from(JwsHeader.with(MacAlgorithm.HS256).build(), claims));
        return new Token(jwt.getTokenValue(), properties.getJwt().getAccessTokenTtl().toSeconds());
    }

    public Token issueFor(long platformUserId, String account, Set<String> roles) {
        Instant issuedAt = Instant.now();
        Instant expiresAt = issuedAt.plus(properties.getJwt().getAccessTokenTtl());
        List<String> authorities = roles.stream().sorted().map(role -> "ROLE_" + role).toList();
        JwtClaimsSet claims = JwtClaimsSet.builder()
                .subject(String.valueOf(platformUserId))
                .issuedAt(issuedAt)
                .expiresAt(expiresAt)
                .claim("preferred_username", account)
                .claim("roles", authorities)
                .build();
        Jwt jwt = jwtEncoder.encode(JwtEncoderParameters.from(JwsHeader.with(MacAlgorithm.HS256).build(), claims));
        return new Token(jwt.getTokenValue(), properties.getJwt().getAccessTokenTtl().toSeconds());
    }

    public record Token(String accessToken, long expiresIn) { }
}