using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
using Tiku.Application.Auth;
using Tiku.Application.Security;
using Tiku.Domain.Tenancy;

namespace Tiku.Infrastructure.Auth;

public sealed class TokenService(IOptions<JwtOptions> options) : ITokenService
{
    private readonly JwtOptions options = options.Value;

    public (string Token, DateTimeOffset ExpiresAt) CreateAccessToken(
        Guid userId,
        Guid sessionId,
        string? phone,
        string? email,
        TenantMembership membership)
    {
        var expiresAt = DateTimeOffset.UtcNow.AddMinutes(options.AccessTokenMinutes);
        var claims = new List<Claim>
        {
            new(TikuClaimTypes.UserId, userId.ToString()),
            new(TikuClaimTypes.SessionId, sessionId.ToString()),
            new(TikuClaimTypes.TenantId, membership.TenantId.ToString()),
            new(TikuClaimTypes.TenantRole, membership.Role.ToString())
        };

        if (!string.IsNullOrWhiteSpace(phone))
        {
            claims.Add(new Claim(TikuClaimTypes.Phone, phone));
        }

        if (!string.IsNullOrWhiteSpace(email))
        {
            claims.Add(new Claim(TikuClaimTypes.Email, email));
        }

        var credentials = new SigningCredentials(
            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(options.SigningKey)),
            SecurityAlgorithms.HmacSha256);
        var token = new JwtSecurityToken(
            options.Issuer,
            options.Audience,
            claims,
            expires: expiresAt.UtcDateTime,
            signingCredentials: credentials);

        return (new JwtSecurityTokenHandler().WriteToken(token), expiresAt);
    }
}