<?php

namespace App\Services;

use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Illuminate\Support\Carbon;
use InvalidArgumentException;
use Firebase\JWT\ExpiredException;
use Firebase\JWT\SignatureInvalidException;

class JwtService
{
    /**
     * 生成访问令牌
     * @param array $payload 自定义载荷（如用户ID、角色）
     * @return string
     */
    public function generateToken(array $payload): string
    {
        $secret = config('app.jwt.secret');
        $algorithm = config('app.jwt.algorithm');
        $expiresAt = Carbon::now()->addSeconds(config('app.jwt.expire'))->timestamp;

        // 标准JWT载荷 + 自定义载荷
        $jwtPayload = array_merge([
            'iss' => config('app.url'), // 签发者
            'iat' => Carbon::now()->timestamp, // 签发时间
            'exp' => $expiresAt, // 过期时间
            'nbf' => Carbon::now()->timestamp, // 生效时间
        ], $payload);

        return JWT::encode($jwtPayload, $secret, $algorithm);
    }

    /**
     * 生成刷新令牌
     * @param int $userId 用户ID
     * @return string
     */
    public function generateRefreshToken(int $userId): string
    {
        $secret = config('app.jwt.secret');
        $algorithm = config('app.jwt.algorithm');
        $expiresAt = Carbon::now()->addSeconds(config('app.jwt.refresh_expire'))->timestamp;

        $refreshPayload = [
            'iss' => config('app.url'),
            'iat' => Carbon::now()->timestamp,
            'exp' => $expiresAt,
            'sub' => 'refresh_token', // 标识为刷新令牌
            'user_id' => $userId,
        ];

        return JWT::encode($refreshPayload, $secret, $algorithm);
    }

    /**
     * 验证并解析JWT令牌
     * @param string $token
     * @return array 解析后的载荷
     * @throws ExpiredException|SignatureInvalidException|InvalidArgumentException
     */
    public function verifyToken(string $token): array
    {
        $secret = config('app.jwt.secret');
        $algorithm = config('app.jwt.algorithm');

        try {
            // 验证并解析令牌
            $decoded = JWT::decode($token, new Key($secret, $algorithm));
            return (array) $decoded;
        } catch (ExpiredException $e) {
            throw new ExpiredException('Token已过期', 401);
        } catch (SignatureInvalidException $e) {
            throw new SignatureInvalidException('Token签名无效', 400);
        } catch (InvalidArgumentException $e) {
            throw new InvalidArgumentException('Token格式错误', 400);
        }
    }

    /**
     * 解析令牌（不验证签名/过期，仅用于读取载荷）
     * @param string $token
     * @return array
     */
    public function decodeTokenWithoutVerify(string $token): array
    {
        $parts = explode('.', $token);
        if (count($parts) !== 3) {
            throw new InvalidArgumentException('Token格式错误');
        }
        $payload = json_decode(base64_decode($parts[1]), true);
        return $payload ?: [];
    }
}