const jwt = require("express-jwt");
const jwksRsa = require("jwks-rsa");

const secure = jwt({
  // Dynamically provide a signing key based on the kid in the header and the signing keys provided by the JWKS endpoint
  secret: jwksRsa.expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://${process.env.SNOWPACK_PUBLIC_AUTH0_DOMAIN}/.well-known/jwks.json`,
  }),

  // Validate the audience and the issuer
  audience: `https://${process.env.SNOWPACK_PUBLIC_API_DOMAIN}/`, //replace with your API's audience, available at Dashboard > APIs
  issuer: `https://${process.env.SNOWPACK_PUBLIC_AUTH0_DOMAIN}/`,
  algorithms: ["RS256"],
});

module.exports = secure;