const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;
const JwtStrategy = require('passport-jwt').Strategy;

// ローカル認証戦略
passport.use(new LocalStrategy({
    usernameField: 'email',
    passwordField: 'password'
  },
  async (email, password, done) => {
    try {
      const user = await User.findOne({ email });
      if (!user || !await user.validatePassword(password)) {
        return done(null, false, { message: 'Invalid credentials' });
      }
      return done(null, user);
    } catch (error) {
      return done(error);
    }
  }
));

// JWT認証戦略
passport.use(new JwtStrategy({
    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
    secretOrKey: process.env.JWT_SECRET
  },
  async (payload, done) => {
    try {
      const user = await User.findById(payload.sub);
      return done(null, user || false);
    } catch (error) {
      return done(error, false);
    }
  }
));

const jwt = require('jsonwebtoken');
const jwksRsa = require('jwks-rsa');

class JWTManager {
    constructor() {
        // 公開鍵の動的取得
        this.jwksClient = jwksRsa({
            cache: true,
            rateLimit: true,
            jwksRequestsPerMinute: 5,
            jwksUri: process.env.JWKS_URI
        });
    }
    
    async signToken(payload, options = {}) {
        const defaultOptions = {
            algorithm: 'RS256',
            expiresIn: '1h',
            issuer: process.env.JWT_ISSUER,
            audience: process.env.JWT_AUDIENCE,
            keyid: process.env.JWT_KEY_ID
        };
        
        return jwt.sign(
            payload,
            process.env.JWT_PRIVATE_KEY,
            { ...defaultOptions, ...options }
        );
    }
    
    async verifyToken(token) {
        const getKey = (header, callback) => {
            this.jwksClient.getSigningKey(header.kid, (err, key) => {
                if (err) return callback(err);
                const signingKey = key.publicKey || key.rsaPublicKey;
                callback(null, signingKey);
            });
        };
        
        return new Promise((resolve, reject) => {
            jwt.verify(token, getKey, {
                algorithms: ['RS256'],
                issuer: process.env.JWT_ISSUER,
                audience: process.env.JWT_AUDIENCE
            }, (err, decoded) => {
                if (err) reject(err);
                else resolve(decoded);
            });
        });
    }
}