using Microsoft.IdentityModel.Tokens;
using System.Text;

namespace MAX.Framework.Security;

/// <summary>
/// JWT 配置选项，默认绑定配置节 <c>Jwt</c>。
/// </summary>
public class JwtOptions
{
	/// <summary>
	/// 配置节名称
	/// </summary>
	public const string SectionName = "Jwt";

	/// <summary>
	/// 签发者
	/// </summary>
	public string Issuer { get; set; } = "StoreHub";

	/// <summary>
	/// 受众
	/// </summary>
	public string Audience { get; set; } = "StoreHub.Client";

	/// <summary>
	/// 签名密钥（HS256，至少 32 字节）
	/// </summary>
	public string SigningKey { get; set; } = "StoreHub-Development-SigningKey-0123456789abcdef0123456789abcdef";

	/// <summary>
	/// 令牌有效期（分钟）
	/// </summary>
	public int ExpiresMinutes { get; set; } = 120;

	/// <summary>
	/// 时钟偏移（分钟），容忍客户端与服务器的时间偏差
	/// </summary>
	public int ClockSkewMinutes { get; set; } = 5;

	/// <summary>
	/// 是否校验签发者
	/// </summary>
	public bool ValidateIssuer { get; set; } = true;

	/// <summary>
	/// 是否校验受众
	/// </summary>
	public bool ValidateAudience { get; set; } = true;

	/// <summary>
	/// 是否校验有效期
	/// </summary>
	public bool ValidateLifetime { get; set; } = true;

	/// <summary>
	/// 根据当前选项构建 <see cref="TokenValidationParameters"/>，用于 JwtBearer 中间件与令牌校验。
	/// </summary>
	public TokenValidationParameters ToTokenValidationParameters()
	{
		byte[] keyBytes = Encoding.UTF8.GetBytes(SigningKey);
		return new TokenValidationParameters
		{
			ValidateIssuerSigningKey = true,
			IssuerSigningKey = new SymmetricSecurityKey(keyBytes),
			ValidateIssuer = ValidateIssuer,
			ValidIssuer = Issuer,
			ValidateAudience = ValidateAudience,
			ValidAudience = Audience,
			ValidateLifetime = ValidateLifetime,
			ClockSkew = TimeSpan.FromMinutes(ClockSkewMinutes),
		};
	}
}