'use strict';

/**
 * JWT Ed25519 密钥加载（EdDSA）。
 * 优先级：环境变量 PEM 明文 → 路径文件 → 默认 keys/ 目录。
 */
const fs = require('fs');
const path = require('path');
const { createPrivateKey, createPublicKey } = require('crypto');

const DEFAULT_DIR = path.join(__dirname, '..', '..', 'keys');
const DEFAULT_PRIVATE = path.join(DEFAULT_DIR, 'jwt_ed25519_private.pem');
const DEFAULT_PUBLIC = path.join(DEFAULT_DIR, 'jwt_ed25519_public.pem');

function normalizePem(value) {
  if (!value) return null;
  return String(value).replace(/\\n/g, '\n').trim();
}

function readFileIfExists(filePath) {
  if (!filePath || !fs.existsSync(filePath)) return null;
  return fs.readFileSync(filePath, 'utf8');
}

function loadJwtKeys() {
  const privatePem =
    normalizePem(process.env.JWT_PRIVATE_KEY) ||
    readFileIfExists(process.env.JWT_PRIVATE_KEY_PATH) ||
    readFileIfExists(DEFAULT_PRIVATE);
  const publicPem =
    normalizePem(process.env.JWT_PUBLIC_KEY) ||
    readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH) ||
    readFileIfExists(DEFAULT_PUBLIC);

  if (!privatePem || !publicPem) {
    throw new Error(
      [
        'JWT Ed25519 密钥未配置。请先生成密钥对：',
        '  node scripts/generate-jwt-keys.js',
        '或设置 JWT_PRIVATE_KEY_PATH / JWT_PUBLIC_KEY_PATH（或 JWT_PRIVATE_KEY / JWT_PUBLIC_KEY）。',
      ].join('\n'),
    );
  }

  const privateKey = createPrivateKey(privatePem);
  const publicKey = createPublicKey(publicPem);
  if (privateKey.asymmetricKeyType !== 'ed25519' || publicKey.asymmetricKeyType !== 'ed25519') {
    throw new Error('JWT 密钥必须为 Ed25519（algorithm=EdDSA）');
  }

  return {
    privateKey,
    publicKey,
    kid: process.env.JWT_KEY_ID || 'ed25519-1',
    algorithm: 'EdDSA',
  };
}

module.exports = { loadJwtKeys, DEFAULT_DIR, DEFAULT_PRIVATE, DEFAULT_PUBLIC };