<dependency>
    <groupId>org.tomitribe</groupId>
    <artifactId>tomitribe-http-signatures</artifactId>
    <version>1.8</version>
</dependency>

import org.tomitribe.auth.signatures.*;
import java.io.*;
import java.net.URL;
import java.nio.charset.Charset;
import java.nio.file.Files;
import java.security.*;
import java.security.interfaces.RSAPrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.*;
import java.util.stream.Collectors;
import java.util.Base64;

/**
 * QSeal signature generation for Neonomics API requests
 * 
 * This example demonstrates the complete flow:
 * 1. Loading QSeal private key from PEM file
 * 2. Creating request digest (for POST/PUT/PATCH)
 * 3. Generating cryptographic signature
 * 4. Building complete HTTP headers
 */
public class NeonomicsQSealSigner {

    public static void main(String[] args) throws Exception {
        // Example usage
        SignedRequest request = createSignedRequest();
        
        System.out.println("=== SIGNED REQUEST HEADERS ===");
        request.getHeaders().forEach((key, value) -> 
            System.out.println(key + ": " + value));
            
        System.out.println("\n=== REQUEST BODY ===");
        System.out.println(request.getBody());
    }

    /**
     * Create a complete signed request ready to send to Neonomics
     */
    public static SignedRequest createSignedRequest() throws Exception {
        // Load your QSeal private key
        RSAPrivateKey privateKey = loadPrivateKey("path/to/qseal-key.pem");
        
        SignedRequest request = new SignedRequest();
        request.setMethod("POST");
        request.setUrl("https://api.neonomics.io/ics/v3/session");
        request.setBody("{\"bankId\":\"YWt0aWEuZmkudjFIRUxTRklISA==\"}");

        // Step 1: Create digest for request body
        String digest = createDigest(request.getBody());

        // Step 2: Prepare required headers
        Map<String, String> headers = new LinkedHashMap<>();
        headers.put("x-originating-host", "neonomics.io");
        headers.put("x-originating-date", getCurrentRFC7231Date());
        headers.put("content-type", "application/json");
        headers.put("digest", digest);

        // Step 3: Generate signature
        String signature = generateSignature(request, headers, privateKey);
        headers.put("signature", signature);

        request.setHeaders(headers);
        return request;
    }

    /**
     * Load RSA private key from PEM file
     */
    public static RSAPrivateKey loadPrivateKey(String filePath) throws Exception {
        String keyContent = Files.readString(new File(filePath).toPath());
        
        // Remove PEM headers and whitespace
        String privateKeyPEM = keyContent
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replace("-----END PRIVATE KEY-----", "")
                .replaceAll("\\s", "");

        // Decode and create key
        byte[] encoded = Base64.getDecoder().decode(privateKeyPEM);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(encoded);
        
        return (RSAPrivateKey) keyFactory.generatePrivate(keySpec);
    }

    /**
     * Create SHA-256 digest header for request body
     */
    private static String createDigest(String body) throws NoSuchAlgorithmException {
        MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
        byte[] hash = sha256.digest(body.getBytes(Charset.forName("UTF-8")));
        return "SHA-256=" + Base64.getEncoder().encodeToString(hash);
    }

    /**
     * Generate cryptographic signature using Tomitribe library
     */
    private static String generateSignature(SignedRequest request, 
                                          Map<String, String> headers, 
                                          PrivateKey privateKey) throws IOException {
        URL url = new URL(request.getUrl());
        
        // Define headers to include in signature
        List<String> headerNames = headers.keySet().stream()
                .map(String::toLowerCase)
                .collect(Collectors.toList());
        headerNames.add("(request-target)");

        // Create signature configuration
        String keyId = "your-neonomics-app-id"; // Replace with your actual ID
        Signature signatureConfig = new Signature(keyId, "rsa-sha256", null, headerNames);
        Signer signer = new Signer(privateKey, signatureConfig);

        // Generate path with query parameters
        String path = url.getPath();
        if (url.getQuery() != null) {
            path += "?" + url.getQuery();
        }

        // Create and return signature
        Signature signature = signer.sign(request.getMethod(), path, headers);
        return signature.toString();
    }

    /**
     * Get current date in RFC 7231 format
     */
    private static String getCurrentRFC7231Date() {
        // Implementation would return current date in RFC 7231 format
        // For example: "Mon, 07 Feb 2023 00:28:05 GMT"
        return "Mon, 07 Feb 2023 00:28:05 GMT";
    }

    /**
     * Simple data structure to hold request information
     */
    public static class SignedRequest {
        private String method;
        private String url;
        private String body;
        private Map<String, String> headers = new HashMap<>();

        // Getters and setters
        public String getMethod() { return method; }
        public void setMethod(String method) { this.method = method; }
        
        public String getUrl() { return url; }
        public void setUrl(String url) { this.url = url; }
        
        public String getBody() { return body; }
        public void setBody(String body) { this.body = body; }
        
        public Map<String, String> getHeaders() { return headers; }
        public void setHeaders(Map<String, String> headers) { this.headers = headers; }
    }
}