const rsaPublicKeyPem = require('../rsa-public-key-pem')
let authKeysCache = null

module.exports = class Auth {
  constructor (options) {
    this.options = Object.assign({
      baseUrl: 'https://appleid.apple.com',
      timeout: 10000
    }, options)
  }

  async _fetch (url, options) {
    const { baseUrl } = this.options
    return uniCloud.httpclient.request(baseUrl + url, options)
  }

  async verifyIdentityToken (identityToken) {
    // 解密出kid，拿取key
    const jwtHeader = identityToken.split('.')[0]
    const { kid } = JSON.parse(Buffer.from(jwtHeader, 'base64').toString())
    let authKeys
    if (authKeysCache) {
      authKeys = authKeysCache
    } else {
      authKeys = await this.getAuthKeys()
      authKeysCache = authKeys
    }
    const usedKey = authKeys.find(item => item.kid === kid)

    /**
     * identityToken 格式
     *
     * {
     *   iss: 'https://appleid.apple.com',
     *   aud: 'io.dcloud.hellouniapp',
     *   exp: 1610626724,
     *   iat: 1610540324,
     *   sub: '000628.30119d332d9b45a3be4a297f9391fd5c.0403',
     *   c_hash: 'oFfgewoG36cJX00KUbj45A',
     *   email: 'x2awmap99s@privaterelay.appleid.com',
     *   email_verified: 'true',
     *   is_private_email: 'true',
     *   auth_time: 1610540324,
     *   nonce_supported: true
     * }
     */
    const payload = require('jsonwebtoken').verify(
      identityToken,
      rsaPublicKeyPem(usedKey.n, usedKey.e),
      {
        algorithms: usedKey.alg
      }
    )

    if (payload.iss !== 'https://appleid.apple.com' || payload.aud !== this.options.bundleId) {
      throw new Error('Invalid identity token')
    }

    return {
      openid: payload.sub,
      email: payload.email,
      emailVerified: payload.email_verified === 'true',
      isPrivateEmail: payload.is_private_email === 'true'
    }
  }

  async getAuthKeys () {
    const { status, data } = await this._fetch('/auth/keys', {
      method: 'GET',
      dataType: 'json',
      timeout: this.options.timeout
    })
    if (status !== 200) throw new Error('request https://appleid.apple.com/auth/keys fail')
    return data.keys
  }
}