package com.example.helloworld.util;

import java.text.ParseException;

import org.joda.time.DateTime;

import com.example.helloworld.core.Token;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSSigner;
import com.nimbusds.jose.crypto.MACSigner;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.ReadOnlyJWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;

public final class AuthUtils {
	
	public static final JWSHeader JWT_HEADER = new JWSHeader(JWSAlgorithm.HS256);
	public static final String AUTH_HEADER_KEY = "Authorization";
	
	public static String getSerializedToken(String authHeader) {
		return authHeader.split(" ")[1];
	}
	
	public static String getSubject(String authHeader) throws ParseException {
		return decodeToken(authHeader).getSubject();
	}
	
	public static ReadOnlyJWTClaimsSet decodeToken(String authHeader) throws ParseException {
		return SignedJWT.parse(getSerializedToken(authHeader)).getJWTClaimsSet();
	}
	
	public static Token createToken(String host, long sub, String clientSecret) throws JOSEException {
		JWTClaimsSet claim = new JWTClaimsSet();
		claim.setSubject(Long.toString(sub));
		claim.setIssuer(host);
		claim.setIssueTime(DateTime.now().toDate());
		claim.setExpirationTime(DateTime.now().plusDays(14).toDate());
		
		JWSSigner signer = new MACSigner(clientSecret);
		SignedJWT jwt = new SignedJWT(JWT_HEADER, claim);
		jwt.sign(signer);
		
		return new Token(jwt.serialize());
	}
}

@@ -484,29 +484,30 @@
 Utils %7B%0A%09%0A%09p
-ublic
+rivate
  static fina
@@ -566,16 +566,81 @@
 HS256);%0A
+%09private static final String TOKEN_SECRET = %22aliceinwonderland%22;%0A
 %09public 
@@ -696,16 +696,18 @@
 ion%22;%0A%09%0A
+%09%0A
 %09public 
@@ -1158,29 +1158,8 @@
  sub
-, String clientSecret
 ) th
@@ -1441,20 +1441,20 @@
 ner(
-clientSecret
+TOKEN_SECRET
 );%0A%09

Should be using a token secret for encoding the JWT, not client secret