package common

import (
	"errors"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

const jwtSecret = "rag-local-jwt-secret-2026"

const TokenExpireSeconds = 24 * 3600

type JwtClaims struct {
	Role    string `json:"role"`
	TokenFp string `json:"token_fp"`
	jwt.RegisteredClaims
}

func GetJwtSecret() string {
	return jwtSecret
}

func SignToken(role, tokenFp string, expireSeconds int64) (string, error) {
	claims := JwtClaims{
		Role:    role,
		TokenFp: tokenFp,
		RegisteredClaims: jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(expireSeconds) * time.Second)),
		},
	}
	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(jwtSecret))
}

// ---------- 访问令牌（内存持有，每次启动重新生成，不落库） ----------

var accessToken string

func SetAccessToken(token string) {
	accessToken = token
}

func CheckAccessToken(token string) bool {
	return accessToken != "" && token == accessToken
}

func AccessTokenFingerprint() string {
	return TokenFingerprint(accessToken)
}

func ParseToken(tokenStr string) (*JwtClaims, error) {
	token, err := jwt.ParseWithClaims(tokenStr, &JwtClaims{}, func(token *jwt.Token) (interface{}, error) {
		return []byte(jwtSecret), nil
	})
	if err != nil {
		return nil, err
	}
	claims, ok := token.Claims.(*JwtClaims)
	if !ok || !token.Valid {
		return nil, errors.New("invalid token")
	}
	return claims, nil
}