import { ApiPropertyOptional } from "@nestjs/swagger";
import { createZodDto } from "nestjs-zod";
import { z } from "zod";

export enum IssuerRegistrationCertificateMode {
    IMPORT = "import",
    GENERATE = "generate",
}

const IssuerProvidedAttestationSchema = z
    .object({
        credentialConfigId: z.string().optional(),
        format: z.string().optional(),
        meta: z.record(z.string(), z.unknown()).optional(),
    })
    .strict();

const IssuerRegistrationCertificateConfigSchema = z
    .object({
        enabled: z.boolean().optional(),
        mode: z.enum(IssuerRegistrationCertificateMode).optional(),
        jwt: z.string().optional(),
        privacyPolicy: z.string().optional(),
        supportUri: z.string().optional(),
    })
    .strict();

const IssuerRegistrationCertificateCacheSchema = z
    .object({
        jwt: z.string(),
        fingerprint: z.string(),
        issuedAt: z.number().optional(),
        expiresAt: z.number().optional(),
    })
    .strict();

export class IssuerProvidedAttestation extends createZodDto(
    IssuerProvidedAttestationSchema,
) {
    @ApiPropertyOptional({
        description:
            "Credential configuration ID backing this attestation entry (for payload traceability/UI mapping).",
        example: "pid-no-key",
    })
    credentialConfigId?: string;

    @ApiPropertyOptional({
        description:
            "Attestation format as expected by the registrar (for example dc+sd-jwt, mso_mdoc).",
        example: "dc+sd-jwt",
    })
    format?: string;

    @ApiPropertyOptional({
        description:
            "Arbitrary attestation metadata forwarded to the registrar.",
        type: "object",
        additionalProperties: true,
    })
    meta?: Record<string, unknown>;
}

export class IssuerRegistrationCertificateConfig extends createZodDto(
    IssuerRegistrationCertificateConfigSchema,
) {
    @ApiPropertyOptional({
        description:
            "Enable inclusion of a registration certificate in credential issuer metadata.",
        default: false,
    })
    enabled?: boolean;

    @ApiPropertyOptional({
        enum: IssuerRegistrationCertificateMode,
        description:
            "import: use an existing JWT, generate: create via registrar using attestation data derived from configured credential configurations.",
        default: IssuerRegistrationCertificateMode.GENERATE,
    })
    mode?: IssuerRegistrationCertificateMode;

    @ApiPropertyOptional({
        description:
            "Existing registration certificate JWT used when mode is import.",
    })
    jwt?: string;

    @ApiPropertyOptional({
        description:
            "Privacy policy URL used when generating a registration certificate (optional if registrar defaults are configured).",
        example: "https://issuer.example/privacy",
    })
    privacyPolicy?: string;

    @ApiPropertyOptional({
        description:
            "Support URI used when generating a registration certificate (optional if registrar defaults are configured).",
        example: "mailto:support@issuer.example",
    })
    supportUri?: string;
}

export class IssuerRegistrationCertificateCache extends createZodDto(
    IssuerRegistrationCertificateCacheSchema,
) {
    @ApiPropertyOptional({
        description:
            "Cached registration certificate JWT generated by EUDIPLO.",
        readOnly: true,
    })
    jwt!: string;

    @ApiPropertyOptional({
        description: "Config fingerprint used to detect cache invalidation.",
        readOnly: true,
    })
    fingerprint!: string;

    @ApiPropertyOptional({
        description: "JWT iat claim, seconds since epoch.",
        readOnly: true,
    })
    issuedAt?: number;

    @ApiPropertyOptional({
        description: "JWT exp claim, seconds since epoch.",
        readOnly: true,
    })
    expiresAt?: number;
}