class Stytch::M2M

def authenticate_token(
  access_token:,
  required_scopes: nil,
  max_token_age: nil,
  scope_authorization_func: method(:perform_authorization_check),
  clock_tolerance_seconds: nil
)
  # Intentionally allow this to re-raise if authentication fails
  decoded_jwt = authenticate_token_local(access_token, clock_tolerance_seconds: clock_tolerance_seconds)
  iat_time = Time.at(decoded_jwt['iat']).to_datetime
  # Token too old
  raise JWTExpiredError if !max_token_age.nil? && (iat_time + max_token_age < Time.now)
  resp = marshal_jwt_into_response(decoded_jwt)
  unless required_scopes.nil?
    is_authorized = scope_authorization_func.call(
      has_scopes: resp['scopes'],
      required_scopes: required_scopes
    )
    raise M2MPermissionError.new(resp['scopes'], required_scopes) unless is_authorized
  end
  resp
end

def authenticate_token_local(jwt, clock_tolerance_seconds: nil)
  clock_tolerance_seconds = 0 if clock_tolerance_seconds.nil?
  issuer = 'stytch.com/' + @project_id
  begin
    decoded_token = JWT.decode jwt, nil, true,
                               { jwks: @jwks_loader, iss: issuer, verify_iss: true, aud: @project_id, verify_aud: true, algorithms: ['RS256'], nbf_leeway: clock_tolerance_seconds }
    decoded_token[0]
  rescue JWT::InvalidIssuerError
    raise JWTInvalidIssuerError
  rescue JWT::InvalidAudError
    raise JWTInvalidAudienceError
  rescue JWT::ExpiredSignature
    raise JWTExpiredSignatureError
  rescue JWT::IncorrectAlgorithm
    raise JWTIncorrectAlgorithmError
  end
end

def get_jwks(
  project_id:
)
  headers = {}
  query_params = {}
  path = @is_b2b_client ? "/v1/b2b/sessions/jwks/#{project_id}" : "/v1/sessions/jwks/#{project_id}"
  request = request_with_query_params(path, query_params)
  get_request(request, headers)
end

def initialize(connection, project_id, is_b2b_client)
  @connection = connection
  @clients = Stytch::M2M::Clients.new(@connection)
  @project_id = project_id
  @cache_last_update = 0
  @is_b2b_client = is_b2b_client
  @jwks_loader = lambda do |options|
    @cached_keys = nil if options[:invalidate] && @cache_last_update < Time.now.to_i - 300
    @cached_keys ||= begin
      @cache_last_update = Time.now.to_i
      keys = []
      get_jwks(project_id: @project_id)['keys'].each do |r|
        keys << r
      end
      { keys: keys }
    end
  end
end

def marshal_jwt_into_response(jwt)
  # The custom claim set is all the claims in the payload except for the standard claims.
  # The cleanest way to collect those seems to be naming what we want
  # to omit and filtering the rest to collect the custom claims.
  reserved_claims = %w[aud exp iat iss jti nbf sub]
  custom_claims = jwt.reject { |key, _| reserved_claims.include?(key) }
  {
    'scopes' => jwt['scope'].split(' '),
    'client_id' => jwt['sub'],
    'custom_claims' => custom_claims
  }
end

def perform_authorization_check(
  has_scopes:,
  required_scopes:
)
  client_scopes = Hash.new { |hash, key| hash[key] = Set.new }
  has_scopes.each do |scope|
    action = scope
    resource = '-'
    action, resource = scope.split(':') if scope.include?(':')
    client_scopes[action].add(resource)
  end
  required_scopes.each do |required_scope|
    required_action = required_scope
    required_resource = '-'
    required_action, required_resource = required_scope.split(':') if required_scope.include?(':')
    return false unless client_scopes.key?(required_action)
    resources = client_scopes[required_action]
    # The client can either have a wildcard resource or the specific resource
    return false unless resources.include?('*') || resources.include?(required_resource)
  end
  true
end

def token(client_id:, client_secret:, scopes: nil)
  headers = {}
  request = {
    grant_type: 'client_credentials',
    client_id: client_id,
    client_secret: client_secret
  }
  request[:scope] = scopes.join(' ') unless scopes.nil?
  post_request("/v1/public/#{@project_id}/oauth2/token", request, headers)
end