using System.IdentityModel.Tokens.Jwt;
using System.Security.Cryptography;
using Microsoft.IdentityModel.Tokens;

namespace Distribution.Middleware;

public class AuthMiddleware(RequestDelegate next, IConfiguration config)
{
    public async Task InvokeAsync(HttpContext context)
    {
        var token = context.Request.Headers.Authorization
            .ToString()
            .Replace("Bearer ", "", StringComparison.OrdinalIgnoreCase)
            .Trim();

        if (string.IsNullOrEmpty(token))
            token = context.Request.Cookies["access-token"] ?? string.Empty;

        if (!string.IsNullOrEmpty(token))
        {
            var publicKeyXml = config["Jwt:PublicKey"];
            if (!string.IsNullOrEmpty(publicKeyXml))
            {
                try
                {
                    var rsa = RSA.Create();
                    rsa.FromXmlString(publicKeyXml);
                    var principal = new JwtSecurityTokenHandler().ValidateToken(token,
                        new TokenValidationParameters
                        {
                            ValidateIssuerSigningKey = true,
                            IssuerSigningKey = new RsaSecurityKey(rsa),
                            ValidAlgorithms = [SecurityAlgorithms.RsaSha256],
                            ValidateIssuer = true,
                            ValidIssuer = config["Jwt:Issuer"],
                            ValidateAudience = true,
                            ValidAudience = config["Jwt:Audience"],
                            ValidateLifetime = true,
                            ClockSkew = TimeSpan.FromMinutes(1)
                        }, out _);

                    context.User = principal;
                }
                catch { }
            }
        }

        await next(context);
    }
}