using System;
using System.IdentityModel.Tokens.Jwt;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.IdentityModel.Tokens;

namespace GB5Shared.Auth.Jwt
{
    public class JwtAccessTokenIssuer : IJwtAccessTokenIssuer
    {
        private readonly IJwtSigningKeyResolver _SigningKeyResolver;

        public JwtAccessTokenIssuer(IJwtSigningKeyResolver signingKeyResolver)
            => _SigningKeyResolver = signingKeyResolver;

        public async Task<JwtIssuedAccessToken> IssueAsync(
            IJwtClaimsSource claims,
            string signingKeyVaultPath,
            string issuer,
            string audience,
            int accessTokenMinutes,
            CancellationToken ct)
        {
            var signingKey = await _SigningKeyResolver.GetSigningKeyAsync(signingKeyVaultPath, ct)
                .ConfigureAwait(false);
            var key   = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(signingKey));
            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

            var expiresOn = DateTime.UtcNow.AddMinutes(accessTokenMinutes);

            var token = new JwtSecurityToken(
                issuer:             issuer,
                audience:           audience,
                claims:             claims.ToClaims(),
                expires:            expiresOn,
                signingCredentials: creds);

            return new JwtIssuedAccessToken
            {
                AccessToken = new JwtSecurityTokenHandler().WriteToken(token),
                ExpiresOn   = expiresOn
            };
        }
    }
}