package cognitoauth

import (
	"sync"
	"time"

	"github.com/lestrrat-go/jwx/v2/jwk"
)

// TokenResponse represents the response from the token endpoint
// Returned by Cognito when exchanging an authorization code for tokens
type TokenResponse struct {
	IDToken      string `json:"id_token"`      // OpenID Connect ID token containing user claims
	AccessToken  string `json:"access_token"`  // OAuth2 access token for accessing resources
	RefreshToken string `json:"refresh_token"` // Token used to get new access tokens without re-authentication
	ExpiresIn    int    `json:"expires_in"`    // Token validity period in seconds
	TokenType    string `json:"token_type"`    // Type of token, typically "Bearer"
}

// PKCESession stores PKCE code verifier for verification
// We need to store the code verifier temporarily to use during token exchange
type PKCESession struct {
	CodeVerifier string
	CreatedAt    time.Time
	ExpiresAt    time.Time
}

// JWKSCache caches the JWKS to avoid frequent fetches
// Implements a thread-safe caching mechanism with expiration
type JWKSCache struct {
	KeySet    jwk.Set      // The cached JSON Web Key Set
	ExpiresAt time.Time    // Expiration time for the cache
	mutex     sync.RWMutex // Mutex for thread-safe access
}

// Global map to store PKCE sessions by state parameter
// In a production environment, this should be replaced with a proper session store
var pkceSessionMap = struct {
	sync.RWMutex
	sessions map[string]*PKCESession
}{
	sessions: make(map[string]*PKCESession),
}

// Global JWKS cache instance
var jwksCache = &JWKSCache{
	ExpiresAt: time.Now(), // Initial state is expired, forcing a fetch on first use
}

// UserInfo represents the user information extracted from JWT claims
type UserInfo struct {
	Username string   // Username from the token
	Email    string   // Email from the token
	Groups   []string // Groups the user belongs to
}