<?php

namespace App\Security;

use App\Contracts\Services\JwtServiceInterface;
use App\Repository\UserRepository;
use SensitiveParameter;
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Http\AccessToken\AccessTokenHandlerInterface;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;

readonly class JwtHandler implements AccessTokenHandlerInterface
{
    public function __construct(private JwtServiceInterface $jwtService, private UserRepository $userRepository)
    {
    }

    public function getUserBadgeFrom(#[SensitiveParameter] string $accessToken): UserBadge
    {
        if ($this->jwtService->isTokenValid($accessToken)) {
            $identifier = $this->jwtService->parseJwt($accessToken, 'email');

            // should be a rare occurrence but check anyway.
            if ($identifier === null) {
                throw new BadCredentialsException('Invalid credentials.');
            }

            $user = $this->userRepository->find($identifier);

            if ($user === null) {
                throw new BadCredentialsException('Invalid credentials.');
            }

            return new UserBadge($user->getUserIdentifier());
        }

        throw new BadCredentialsException('Invalid credentials.');
    }
}