// assets-ai/src/lib/jwt.ts — 引用共享 JWT，保持原有接口
import { verifyJwt } from '@shared/lib/auth/jwt'
import { signJwtV2 } from '@shared/lib/auth/jwt-v2'
import type { AuthConfig } from '@shared/lib/auth/types'

// 从环境变量读取配置
const config: AuthConfig = {
  jwtSecret: process.env.JWT_SECRET || 'default-secret-change-me',
  cookieDomain: process.env.COOKIE_DOMAIN || '',
  autheliaUrl: '', oidcClientId: '', oidcClientSecret: '', oidcRedirectUri: '',
}

export interface SharedSession {
  username: string
  displayName: string
  iat: number
  exp: number
}

// 保持原有签名：signSharedJwt(payload, expiresIn)
export function signSharedJwt(
  payload: { username: string; displayName: string },
  expiresIn: number = 7 * 24 * 60 * 60
): string {
  return signJwtV2({ secret: config.jwtSecret, payload, iss: 'assets.tlyq.ai', expiresInSeconds: expiresIn })
}

// 保持原有签名：verifySharedJwt(token)
export function verifySharedJwt(token: string): SharedSession | null {
  const payload = verifyJwt(token, config.jwtSecret)
  if (!payload) return null
  return {
    username: payload.username as string,
    displayName: (payload.displayName || payload.username) as string,
    iat: payload.iat as number,
    exp: payload.exp as number,
  }
}

// 保持原有签名：sharedCookieConfig(maxAge)
export function sharedCookieConfig(maxAge: number = 7 * 24 * 60 * 60) {
  return {
    name: 'tlyq_session',
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax' as const,
    domain: config.cookieDomain || undefined,
    path: '/',
    maxAge,
  }
}