import { jwtVerify } from "jose";

export async function verifyAssertion(token, publicKey, now = new Date()) {
  const { payload } = await jwtVerify(token, publicKey, {
    algorithms: ["RS256"],
    issuer: "urn:example:support-gateway",
    audience: "urn:example:support-origin",
    typ: "support-assertion+jwt",
    requiredClaims: ["sub", "sid", "iat", "exp"],
    maxTokenAge: "30s",
    currentDate: now,
  });
  if (typeof payload.sub !== "string" || !payload.sub ||
      typeof payload.sid !== "string" || !payload.sid) {
    throw new Error("Invalid identity claims");
  }
  return { subject: payload.sub, sessionId: payload.sid };
}