package com.lincfusion.udyamlinc.security;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import java.security.Key;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

/** Issues and reads the two token flavours: officer console and enterprise app. */
@Component
public class JwtUtil {

    @Value("${jwt.secret}")
    private String secret;

    @Value("${jwt.expiration:86400000}")
    private long expirationMs;

    private Key signingKey() {
        return Keys.hmacShaKeyFor(secret.getBytes());
    }

    /** Field officer session — scope=OFFICER, carries the role and the blocks in view. */
    public String generateOfficerToken(String username, String role, String blocks) {
        Map<String, Object> claims = new HashMap<>();
        claims.put("realm", "UDYAM");
        claims.put("scope", "OFFICER");
        claims.put("role", role);
        claims.put("blocks", blocks);
        return build(claims, username);
    }

    /**
     * Enterprise app session — scope=ENTERPRISE, pinned to one enterprise id so
     * the owner can only ever read their own record.
     */
    public String generateEnterpriseToken(String enterpriseId, String sector) {
        Map<String, Object> claims = new HashMap<>();
        claims.put("realm", "UDYAM");
        claims.put("scope", "ENTERPRISE");
        claims.put("role", "OWNER");
        claims.put("enterpriseId", enterpriseId);
        claims.put("sector", sector);
        return build(claims, enterpriseId);
    }

    private String build(Map<String, Object> claims, String subject) {
        long now = System.currentTimeMillis();
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(subject)
                .setIssuedAt(new Date(now))
                .setExpiration(new Date(now + expirationMs))
                .signWith(signingKey(), SignatureAlgorithm.HS256)
                .compact();
    }

    public Claims parse(String token) {
        return Jwts.parserBuilder().setSigningKey(signingKey()).build().parseClaimsJws(token).getBody();
    }

    public String subject(String token) {
        return parse(token).getSubject();
    }

    public String scope(String token) {
        return String.valueOf(parse(token).get("scope"));
    }

    public String role(String token) {
        return String.valueOf(parse(token).get("role"));
    }

    public boolean isValid(String token) {
        try {
            return parse(token).getExpiration().after(new Date());
        } catch (Exception e) {
            return false;
        }
    }
}