<?php

/**
 * This program is copyrighted by Franz Geffke (Softmax Co., Ltd.)
 */

namespace ones\oidc;

use Firebase\JWT\JWT;

/**
 * Make device JWT
 * OpenID client assertion JWT
 *
 * @param string $clientId The client ID
 * @param array $providerMetadata The OpenID provider metadata
 * @param string $privateKey The private key (PEM)
 */
function make_device_jwt($clientId, $providerMetadata, $privateKey) {
    $now = time();
    $payload = [
        'iss' => $clientId,
        'sub' => $clientId,
        'aud' => $providerMetadata['issuer'],
        'jti' => bin2hex(random_bytes(16)),
        'iat' => $now,
        'exp' => $now + 300,
        'nbf' => $now
    ];

    $header = [
        'alg' => 'RS256',
        'typ' => 'JWT'
    ];

    $jwt = JWT::encode($payload, $privateKey, 'RS256', null, $header);
    return $jwt;
}

?>