import jwt
import time

from opencopilot import settings
from opencopilot.service import error_responses


def execute(client_id: str, client_secret: str, user_id: str) -> str:
    if client_id != settings.get().JWT_CLIENT_ID or client_secret != settings.get().JWT_CLIENT_SECRET:
        raise error_responses.InvalidCredentialsAPIError

    payload = {
            'iat': time.time() - 100,
            'exp': time.time() + settings.get().JWT_TOKEN_EXPIRATION_SECONDS,
            'sub': user_id
        }
    return jwt.encode(payload, settings.get().JWT_CLIENT_SECRET, algorithm='HS256')
