import { jwtVerify, importJWK } from 'jose';
import { base58btc } from 'multiformats/bases/base58';
import * as ed25519 from '@noble/ed25519';

/**
 * Verify did:key JWT authentication
 * @param {string} token - Bearer token
 * @param {string} audience - Expected audience (server URL)
 * @returns {string} - WebID derived from did:key
 */
export async function verifyDidKeyJWT(token, audience) {
  // Decode without verification to get DID
  const { payload } = await jwtVerify(token, async (header, token) => {
    const did = token.payload.sub;
    
    if (!did?.startsWith('did:key:')) {
      throw new Error('Invalid DID format');
    }
    
    // Extract public key from did:key
    const publicKey = await didKeyToPublicKey(did);
    return publicKey;
  });
  
  // Validate LWS10 constraints
  if (payload.sub !== payload.iss || payload.sub !== payload.client_id) {
    throw new Error('sub, iss, and client_id must be identical');
  }
  
  if (!Array.isArray(payload.aud) || !payload.aud.includes(audience)) {
    throw new Error('Invalid audience');
  }
  
  if (!payload.exp || !payload.iat) {
    throw new Error('Missing exp or iat claims');
  }
  
  // Return WebID (in our case, same as DID for now)
  return payload.sub;
}

/**
 * Extract public key from did:key identifier
 * Supports ed25519, P-256, secp256k1
 */
async function didKeyToPublicKey(did) {
  const multibaseKey = did.replace('did:key:', '');
  const bytes = base58btc.decode(multibaseKey);
  
  // First 2 bytes are multicodec prefix
  const codec = (bytes[0] << 8) | bytes[1];
  const publicKeyBytes = bytes.slice(2);
  
  switch (codec) {
    case 0xed: // Ed25519
      return await ed25519PublicKeyToJWK(publicKeyBytes);
    case 0x1200: // P-256
      return await p256PublicKeyToJWK(publicKeyBytes);
    default:
      throw new Error(`Unsupported key type: 0x${codec.toString(16)}`);
  }
}

async function ed25519PublicKeyToJWK(publicKeyBytes) {
  return {
    kty: 'OKP',
    crv: 'Ed25519',
    x: Buffer.from(publicKeyBytes).toString('base64url')
  };
}

import { verifyDidKeyJWT } from './did-key.js';

// In authorize() function, add did:key support:
if (authHeader?.startsWith('Bearer ')) {
  const token = authHeader.slice(7);
  
  try {
    // Try did:key JWT first
    const webId = await verifyDidKeyJWT(token, request.hostname);
    return { authorized: true, webId };
  } catch (didKeyErr) {
    // Fall through to existing token/OIDC validation
  }
}

// bin/jss.js
program
  .command('auth')
  .command('generate-did-key')
  .description('Generate did:key credentials for agent authentication')
  .action(async () => {
    const { privateKey, publicKey } = await ed25519.utils.randomPrivateKey();
    const did = await publicKeyToDidKey(publicKey);
    
    console.log('Generated did:key credentials:');
    console.log(`\nDID: ${did}`);
    console.log(`Private Key (hex): ${Buffer.from(privateKey).toString('hex')}`);
    console.log('\nSave private key securely. Use it to sign JWTs for authentication.');
  });

import { SignJWT } from 'jose';
import * as ed25519 from '@noble/ed25519';

const privateKeyHex = '9d61b19...';
const did = 'did:key:z6Mk...';

const jwt = await new SignJWT({})
  .setProtectedHeader({ alg: 'EdDSA' })
  .setSubject(did)
  .setIssuer(did)
  .setAudience('https://solid.social/')
  .claim('client_id', did)
  .setExpirationTime('1h')
  .setIssuedAt()
  .sign(privateKeyFromHex(privateKeyHex));

// Use JWT
const res = await fetch('https://solid.social/alice/private/', {
  headers: { 'Authorization': `Bearer ${jwt}` }
});