import { generateKeyPairSync } from 'crypto';
import jwt from 'jsonwebtoken';
import nock from 'nock';
import { env } from '../../src/config/env';

const KID = 'test-kid';
const CERTS_PATH = `/realms/${env.keycloak.realm}/protocol/openid-connect/certs`;

const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
const jwk = publicKey.export({ format: 'jwk' }) as Record<string, unknown>;
const privateKeyPem = privateKey.export({ type: 'pkcs1', format: 'pem' }) as string;

const { privateKey: rogueKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
export const rogueKeyPem = rogueKey.export({ type: 'pkcs1', format: 'pem' }) as string;

export function mockKeycloakJwks(): void {
  nock(env.keycloak.baseUrl)
    .persist()
    .get(CERTS_PATH)
    .reply(200, { keys: [{ ...jwk, kid: KID, alg: 'RS256', use: 'sig' }] });
}

interface TokenPayload {
  sub: string;
  email?: string;
  name?: string;
  realm_access?: { roles?: string[] };
}

export function signValidToken(payload: TokenPayload, signOptions: jwt.SignOptions = {}): string {
  return jwt.sign(payload, privateKeyPem, {
    algorithm: 'RS256',
    keyid: KID,
    expiresIn: '5m',
    ...signOptions,
  });
}

export function bearer(payload: TokenPayload, signOptions: jwt.SignOptions = {}): string {
  return `Bearer ${signValidToken(payload, signOptions)}`;
}