import { SignJWT, importJWK, type JWK } from 'jose';

export interface GenerateClientAssertionInput {
  clientId: string;
  audience: string;
  privateJwk: JWK;
  expiresIn?: string;
}

export async function generateClientAssertion(
  input: GenerateClientAssertionInput,
): Promise<string> {
  const privateKey = await importJWK(input.privateJwk, 'RS256');
  return new SignJWT({})
    .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
    .setIssuer(input.clientId)
    .setSubject(input.clientId)
    .setAudience(input.audience)
    .setIssuedAt()
    .setExpirationTime(input.expiresIn ?? '2m')
    .sign(privateKey);
}
