using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using FozFc.Api.Configuration;
using Microsoft.IdentityModel.Tokens;

namespace FozFc.Api.Infrastructure.Security;

public sealed class JwtTokenService : IJwtTokenService
{
    private readonly AppOptions _options;

    public JwtTokenService(AppOptions options) => _options = options;

    public string Issue(string uid, string email, string role)
    {
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_options.JwtSecret));
        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var claims = new[]
        {
            new Claim(JwtClaims.Uid, uid),
            new Claim(JwtClaims.Email, email),
            new Claim(JwtClaims.Role, role),
        };

        var token = new JwtSecurityToken(
            issuer: AppOptions.JwtIssuer,
            claims: claims,
            notBefore: DateTime.UtcNow,
            expires: DateTime.UtcNow.AddSeconds(_options.JwtTtlSeconds),
            signingCredentials: credentials);

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

/// <summary>Claim type names used across issuance and authorization.</summary>
public static class JwtClaims
{
    public const string Uid = "uid";
    public const string Email = "email";
    public const string Role = "role";
}