package extensions

import (
	"context"
	"encoding/json"
	"net/http"
	"net/url"

	"github.com/google/go-querystring/query"
)

type CreateExtensionSecretParams struct {
	// The ID of the extension to apply the shared secret to.
	ExtensionID string `url:"extension_id"`

	// The amount of time, in seconds, to delay activating the secret.
	// The delay should provide enough time for instances of the extension to gracefully switch over to the new secret.
	// The minimum delay is 300 seconds (5 minutes).
	// The default is 300 seconds.
	Delay *int `url:"delay,omitempty"`
}

type CreateExtensionSecretResponse struct {
	// A list that contains the newly added secrets.
	Data []ExtensionSecrets `json:"data"`
}

// Creates a shared secret used to sign and verify JWT tokens.
// Creating a new secret removes the current secrets from service.
// Use this function only when you are ready to use the new secret it returns.
//
// Requires a signed JSON Web Token (JWT) created by an EBS. For signing requirements,
// see Signing the JWT: https://dev.twitch.tv/docs/extensions/building/#signing-the-jwt
// The signed JWT must include the role, user_id, and exp fields
// (see JWT Schema: https://dev.twitch.tv/docs/extensions/reference/#jwt-schema).
// The role field must be set to external.
func (c *Extensions) CreateExtensionSecret(ctx context.Context, params *CreateExtensionSecretParams) (*CreateExtensionSecretResponse, error) {
	v, _ := query.Values(params)
	endpoint := c.baseUrl.ResolveReference(&url.URL{Path: "extensions/jwt/secrets", RawQuery: v.Encode()})

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), nil)
	if err != nil {
		return nil, err
	}

	res, err := c.client.Do(req)
	if err != nil {
		return nil, err
	}
	defer res.Body.Close()

	var data CreateExtensionSecretResponse
	if err := json.NewDecoder(res.Body).Decode(&data); err != nil {
		return nil, err
	}

	return &data, nil
}