import type { EBSIVerifiablePresentation } from "@europeum-ebsi/vcdm2.0-presentation-schema";
import type { SupportedAlgs } from "@europeum-ebsi/verifiable-credential";
import type {
  Schemas as VcSchemas,
  TypeExtensions as VcTypeExtensions,
  VerifyCredentialOptions,
} from "@europeum-ebsi/verifiable-credential/vcdm20.js";
import type { RawAxiosRequestHeaders } from "axios";
import type { JsonWebKey } from "did-resolver";
import type { SetRequired } from "type-fest";

import type { ProofPurposeTypes } from "../shared/types.ts";

export interface CreateVerifiablePresentationJwtOptions extends CommonOptions {
  /**
   * Additional header parameters to add to the JWT header
   */
  header?: Partial<VpJwtHeader>;

  /**
   * Additional JWT claims to add to the VC JWT payload
   */
  payload?: Partial<VpJwtClaims>;

  /**
   * Determines whether to validate the Verifiable Presentation payload or not.
   * Validation is active by default.
   *
   * Note: even when skipValidation is set to true, the payload must be a valid
   * EBSI Verifiable Presentation.
   * @defaultValue false
   */
  skipValidation?: boolean;
}

export interface Schemas extends VcSchemas {
  Presentation: EBSIVerifiablePresentation;
}

export type TypeExtensions = VcTypeExtensions;

export interface VerifyPresentationJwtOptions extends CommonOptions {
  /**
   * Time in seconds expanding the validity period of the JWT, both before "nbf" and after "exp". Default : 0 second.
   * Note: the did-jwt library uses a similar `skewTime` parameter with a default value of 5 minutes (300 seconds).
   */
  clockSkew?: number;

  /**
   * Determines whether to validate the signature of the VP JWT or not.
   * Validation is active by default.
   * @defaultValue false
   */
  skipSignatureValidation?: boolean;

  /**
   * Unix timestamp. Optional comparison date. Default: current date and time.
   * For the JWT to be valid, the presentation and all its credentials must be valid at the given time.
   */
  validAt?: number;
}

/**
 * VP JWT payload
 * @see https://www.w3.org/TR/2025/REC-vc-jose-cose-20250515/#securing-with-jose
 */
export interface VpJwtClaims {
  aud?: string; // Note: "aud" could also be an array

  /**
   * "Expiration Time" claim.
   * Expiration time of the signature.
   * Different from the `validUntil` property.
   */
  exp?: number;

  /**
   * "Issued At" claim.
   * Issuance time of the signature.
   * Different from the `validFrom` property.
   */
  iat?: number;

  /**
   * "Issuer" claim.
   * @deprecated Not recommended as it might conflict with the VC `issuer` property.
   */
  iss?: string;

  /**
   * "JWT ID" claim.
   * @deprecated Not recommended as it might conflict with the VC `id` property.
   */
  jti?: string;

  /**
   * "Not Before" claim.
   * @deprecated Not recommended, as it makes little sense to attempt to assign a future date to a signature.
   */
  nbf?: number;

  /**
   * "Subject" claim.
   * @deprecated Not recommended as it might conflict with the VC `credentialSubject.id` property.
   */
  sub?: string;

  /**
   * Additional JWT claims
   */
  // eslint-disable-next-line perfectionist/sort-interfaces
  [x: string]: unknown;
}

export interface VpJwtHeader {
  alg: SupportedAlgs;
  cty?: "vp";
  jwk?: JsonWebKey;
  kid: string;
  typ?: "vp+jwt";
  // eslint-disable-next-line perfectionist/sort-interfaces
  [x: string]: unknown;
}

export type VpJwtPayload = SetRequired<Schemas["Presentation"], "holder"> &
  VpJwtClaims;

/**
 * Options that are common to both `verifyPresentationJwt` and `createVerifiablePresentationJwt`
 */
interface CommonOptions {
  /**
   * Custom Axios request headers
   */
  axiosHeaders?: RawAxiosRequestHeaders;

  /**
   * Verification relationship
   * @defaultValue "authentication"
   */
  proofPurpose?: ProofPurposeTypes;

  /**
   * Determines whether to validate the resolution of the VP holder DID or not.
   * Validation is active by default.
   * @defaultValue false
   */
  skipHolderDidResolutionValidation?: boolean;

  /**
   * Axios requests timeout (in milliseconds). Default: 15 seconds
   */
  timeout?: number;

  /**
   * Credential verification options
   */
  verifyCredentialOptions?: VerifyCredentialOptions;
}