package com.oliver.kidio.backend.security

import com.auth0.jwt.JWT
import com.auth0.jwt.JWTVerifier
import com.auth0.jwt.algorithms.Algorithm
import java.util.Date

class JwtService(
    private val secret: String = System.getenv("JWT_SECRET") ?: "super-geheimes-secret-fuer-dev",
    private val issuer: String = "https://kidio.oliver.com/",
    private val audience: String = "kidio-users",
    private val expirationInMs: Long =  java.util.concurrent.TimeUnit.DAYS.toMillis(30) // 30 Tage
) {

    val verifier: JWTVerifier = JWT
        .require(Algorithm.HMAC256(secret))
        .withAudience(audience)
        .withIssuer(issuer)
        .build()

    /**
     * Generiert ein JWT-Token für einen bestimmten Benutzer.
     */
    fun generateToken(userId: String): String {
        return JWT.create()
            .withAudience(audience)
            .withIssuer(issuer)
            .withClaim("userId", userId)
            .withExpiresAt(Date(System.currentTimeMillis() + expirationInMs))
            .sign(Algorithm.HMAC256(secret))
    }
}