"""Short-lived internal service tokens shared by trusted runtime components."""

from __future__ import annotations

import base64
import hashlib
import hmac
import json
import time


def issue_broker_service_token(
    secret: str,
    project: str,
    environment: str,
    *,
    ttl_seconds: int = 60,
) -> str:
    """Issue a bounded Docker broker token for one validated project context."""

    payload = {
        "aud": "docker-read-broker",
        "project": project,
        "environment": environment,
        "exp": int(time.time()) + ttl_seconds,
    }
    encoded = (
        base64.urlsafe_b64encode(json.dumps(payload, separators=(",", ":")).encode())
        .decode()
        .rstrip("=")
    )
    signature = (
        base64.urlsafe_b64encode(
            hmac.new(secret.encode(), encoded.encode(), hashlib.sha256).digest()
        )
        .decode()
        .rstrip("=")
    )
    return f"{encoded}.{signature}"