import { SignJWT, jwtVerify } from 'jose'
import { config } from '../config.js'

export const PREVIEW_COOKIE_NAME = 'preview_session'

const secret = new TextEncoder().encode(config.preview.sessionSecret)

/** maxAgeSec kuerzer als die Standard-Laufzeit z. B. fuer die Kundenansicht (2 Stunden). */
export async function createPreviewSessionToken(payload, { maxAgeSec = config.preview.sessionMaxAge } = {}) {
  return new SignJWT(payload)
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime(`${maxAgeSec}s`)
    .sign(secret)
}

export async function verifyPreviewSessionToken(token) {
  try {
    const { payload } = await jwtVerify(token, secret)
    return payload
  } catch {
    return null
  }
}

export function previewSessionCookieOptions({ maxAgeSec = config.preview.sessionMaxAge } = {}) {
  return {
    domain: config.preview.cookieDomain,
    path: '/',
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    maxAge: maxAgeSec * 1000,
  }
}

export function clearPreviewSession(res) {
  res.clearCookie(PREVIEW_COOKIE_NAME, {
    domain: config.preview.cookieDomain,
    path: '/',
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
  })
}