import { Body, Controller, HttpCode, HttpStatus, NotFoundException, Post } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { SignJWT } from 'jose';
import { createZodDto } from 'nestjs-zod';
import { DevTokenRequestSchema, type AuthTokenResponse } from '@sar/api-interface';
import type { Env } from '../config/env.schema';
import { Public } from './public.decorator';

class DevTokenRequestDto extends createZodDto(DevTokenRequestSchema) {}

// Dev-only stub — emite JWT HS256 para smoke tests locais.
// CODING-RULES PGD-SEC-002: retorna 404 em produção.
// CODING-RULES PGD-AUTHZ-002: workspace_id vem do body aqui APENAS porque
//   este endpoint É o gerador do token — nenhum outro handler pode fazer isso.

@Public()
@Controller({ path: 'auth/dev' })
export class DevAuthController {
  private readonly secret: Uint8Array;
  private readonly expiresIn: number;
  private readonly isProd: boolean;

  constructor(config: ConfigService<Env, true>) {
    this.secret = new TextEncoder().encode(config.get('MASTER_LOGIN_JWT_SECRET', { infer: true }));
    this.expiresIn = config.get('JWT_ACCESS_EXPIRATION', { infer: true });
    this.isProd = config.get('NODE_ENV', { infer: true }) === 'production';
  }

  @Post('token')
  @HttpCode(HttpStatus.OK)
  async token(@Body() dto: DevTokenRequestDto): Promise<AuthTokenResponse> {
    if (this.isProd) throw new NotFoundException();

    const accessToken = await new SignJWT({
      workspace_id: dto.workspaceId,
      role: dto.role,
    })
      .setProtectedHeader({ alg: 'HS256' })
      .setSubject(dto.userId)
      .setIssuedAt()
      .setExpirationTime(`${this.expiresIn}s`)
      .sign(this.secret);

    return { accessToken, tokenType: 'Bearer', expiresIn: this.expiresIn };
  }
}
