import { createRemoteJWKSet, jwtVerify } from 'jose';
import { config } from './config.js';
import { logger } from './lib/logger.js';

const JWKS = createRemoteJWKSet(new URL(config.proovit.jwksUri));

export async function verifyProovitToken(token: string) {
  try {
    const { payload } = await jwtVerify(token, JWKS, {
      audience: config.proovit.clientId,
    });
    return payload;
  } catch (err) {
    logger.error('Token verification failed', err);
    throw new Error('Invalid token');
  }
}