import jwt from 'jsonwebtoken';
import type { SignatureSessionToken } from './types';

const JWT_SECRET = process.env.JWT_SECRET || process.env.NEXTAUTH_SECRET || 'odentas-sign-secret-key-change-in-production';
const JWT_EXPIRATION = '30m'; // 30 minutes

/**
 * Crée un JWT pour une session de signature
 */
export function createSignatureSession(payload: {
  signerId: string;
  requestId: string;
  email: string;
  role: string;
}): string {
  return jwt.sign(payload, JWT_SECRET, {
    expiresIn: JWT_EXPIRATION,
    issuer: 'odentas-sign',
    audience: 'signature-session'
  });
}

/**
 * Vérifie et décode un JWT de session de signature
 */
export function verifySignatureSession(token: string): SignatureSessionToken | null {
  try {
    const decoded = jwt.verify(token, JWT_SECRET, {
      issuer: 'odentas-sign',
      audience: 'signature-session'
    }) as SignatureSessionToken;
    
    return decoded;
  } catch (error) {
    console.error('[JWT] Erreur de vérification:', error);
    return null;
  }
}

/**
 * Extrait le token JWT depuis le header Authorization
 */
export function extractTokenFromHeader(authHeader: string | null): string | null {
  if (!authHeader) return null;
  
  const parts = authHeader.split(' ');
  if (parts.length !== 2 || parts[0] !== 'Bearer') return null;
  
  return parts[1];
}
