use serde::{Deserialize, Serialize};
use time::Duration;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct JwtSettings {
    /// ID of the signing key used to issue tokens (kid).
    pub issuer: String,
    /// Audience claim that access tokens must carry.
    pub audience: String,
    /// Access token lifetime, e.g. "15m".
    pub access_ttl: Duration,
    /// Refresh token lifetime, e.g. "30d".
    pub refresh_ttl: Duration,
    /// Grace window during which a rotated refresh token is still accepted.
    pub grace_window: Duration,
    /// Clock skew tolerance when validating exp / nbf.
    pub clock_skew_seconds: i64,
    /// Default grace duration for a rotated signing key.
    pub default_grace_duration: Duration,
    /// Signature algorithm used for new keys.
    pub default_key_pair_algorithm: String,
}

impl Default for JwtSettings {
    fn default() -> Self {
        Self {
            issuer: "untitled".to_string(),
            audience: "untitled-api".to_string(),
            access_ttl: Duration::minutes(15),
            refresh_ttl: Duration::days(30),
            grace_window: Duration::minutes(5),
            clock_skew_seconds: 60,
            default_grace_duration: Duration::days(7),
            default_key_pair_algorithm: "EdDSA".to_string(),
        }
    }
}