import type {
  JwtHeader,
  JwtClaims,
  JwtConfig,
  Jwk,
  Keystore,
  RotationPolicy,
} from "@keyloom/core/jwt";

import { createSigner, sign } from "@keyloom/core/jwt";

// Using a signer (preferred)
const signer = createSigner(privateKey, publicKey, "kid123", "EdDSA");
const token = await signer.sign({ iss, sub: userId, iat, exp });

// Direct sign
const token2 = await sign(
  { alg: "EdDSA", kid: "kid123", typ: "JWT" },
  { iss, sub, iat, exp },
  privateKey
);

import { verify, verifyFull } from "@keyloom/core/jwt";

// JWKS array (public keys) is required
const { header, claims } = await verify(token, jwks);

// Full verification with timing and issuer/audience checks
const out = await verifyFull(token, jwks, {
  clockSkewSec: 60,
  expectedIssuer: "https://app.example.com",
  expectedAudience: "my-audience",
});

import {
  newKeystore,
  rotateKeys,
  exportPublicKeys,
  exportJwks,
  genKeyPair,
} from "@keyloom/core/jwt";

// Create and rotate a keystore
let ks = await newKeystore({ alg: "EdDSA" });
ks = await rotateKeys(ks, { rotationDays: 30, overlapDays: 7 });

// Export public keys for verification
const jwks = exportPublicKeys(ks); // JWK[]

// Generate a standalone keypair
const { privateKey, publicKey, kid } = await genKeyPair("EdDSA");

import { newRefreshToken, TokenRotator } from "@keyloom/core/jwt";

// Create a refresh token record for a user
const rec = await newRefreshToken({ userId: "u_1", ttl: "30d" });

// Rotate on use (pseudocode)
const rotator = new TokenRotator(store); // store implements persistence
const { next, revoke } = await rotator.rotate(rec);

import { JWT_ERRORS, JwtError } from "@keyloom/core/jwt";

import { validateJwtClaims, newAccessClaims } from "@keyloom/core/jwt";

import { newKeystore, rotateKeys, exportJwks } from "@keyloom/core/jwt";

let keystorePromise: Promise<any> | null = null;

async function getKeystore() {
  if (!keystorePromise) {
    // In production, load from secure storage (KMS/DB). This demo keeps it in memory.
    keystorePromise = newKeystore({ alg: "EdDSA" });
  }
  return keystorePromise;
}

export async function GET() {
  const ks = await getKeystore();
  // Optional: rotate on schedule
  // const next = await rotateKeys(ks, { rotationDays: 30, overlapDays: 7 });
  // await save(next)
  const jwks = exportJwks(ks);
  return Response.json(jwks, {
    headers: { "cache-control": "public, max-age=300" },
  });
}

import { verifyFull, exportPublicKeys } from "@keyloom/core/jwt";

async function check(token: string, keystore: any) {
  const jwks = exportPublicKeys(keystore);
  try {
    const { claims } = await verifyFull(token, jwks, {
      clockSkewSec: 60,
      expectedIssuer: "https://app.example.com",
      expectedAudience: ["web", "mobile"],
    });
    return claims;
  } catch (err: any) {
    if (err.code === "JWT_EXPIRED") return null;
    throw err;
  }
}

import { TokenRotator, newRefreshToken } from "@keyloom/core/jwt";

type RefreshRow = {
  jti: string;
  userId: string;
  tokenHash: string;
  expiresAt: Date;
  parentJti?: string | null;
};
const memory: Map<string, RefreshRow> = new Map();

const store = {
  async findByJti(jti: string) {
    return memory.get(jti) ?? null;
  },
  async save(row: RefreshRow) {
    memory.set(row.jti, row);
  },
  async revoke(jti: string) {
    const r = memory.get(jti);
    if (r) memory.delete(jti);
  },
};

// Issue initial token
const rec = await newRefreshToken({ userId: "usr_42", ttl: "30d" });
await store.save({
  jti: rec.jti,
  userId: rec.userId,
  tokenHash: rec.tokenHash,
  expiresAt: rec.expiresAt,
});

// On refresh endpoint
const rotator = new TokenRotator(store as any);
const result = await rotator.rotate(rec);
await store.save(result.next as any); // persist new row
await store.revoke(rec.jti); // revoke old

try {
  await verifyFull(token, jwks, { expectedIssuer: env.JWT_ISSUER });
} catch (err: any) {
  switch (err.code) {
    case "JWT_MALFORMED":
    case "JWT_EXPIRED":
    case "JWT_NOT_BEFORE":
    case "JWT_INVALID_ISSUER":
    case "JWT_INVALID_AUDIENCE":
      // map to 401 / 403 as needed
      break;
    default:
    // 500 or generic error
  }
}