"claims": {
      "vc.credentialSubject.givenName": {
        "type": "String",
        "label": "Name"
      },
      "vc.credentialSubject.surname": {
        "type": "String",
        "label": "Surname"
      },
      "vc.credentialSubject.mail": {
        "type": "String",
        "label": "Email"
      },
      "vc.credentialSubject.jobTitle": {
        "type": "String",
        "label": "Job title"
      },
      "vc.credentialSubject.photo": {
        "type": "image/jpg;base64url",
        "label": "User picture"
      },
      "vc.credentialSubject.displayName": {
        "type": "String",
        "label": "Display name"
      },
      "vc.credentialSubject.preferredLanguage": {
        "type": "String",
        "label": "Preferred language"
      },
      "vc.credentialSubject.revocationId": {
        "type": "String",
        "label": "Revocation id"
      }
    },

public async Task OnGetAsync()
{
	var oid = User.Claims
		.FirstOrDefault(t => t.Type == Consts.OID_TYPE);
	
	var employeeData = await _microsoftGraphDelegatedClient
		.GetEmployee(oid!.Value);

	if (employeeData.Employee != null)
	{
		Employee = new Employee
		{
			DisplayName = employeeData.Employee.DisplayName!,
			GivenName = employeeData.Employee.GivenName!,
			JobTitle = employeeData.Employee.JobTitle!,
			Surname = employeeData.Employee.Surname!,
			PreferredLanguage = employeeData.Employee.PreferredLanguage!,
			Mail = employeeData.Employee.Mail!,
			RevocationId = employeeData.Employee.RevocationId!,
			Photo = employeeData.Employee.Photo,
			AccountEnabled = employeeData.Employee.AccountEnabled
		};
		EmployeeMessage = "Add your employee credentials to your wallet";
		HasEmployee = true;
		Photo = Base64UrlEncoder.DecodeBytes(Employee.Photo);
	}
	else
	{
		EmployeeMessage = 
			$"You have no valid employee, Error: {employeeData.Error}";
		if(employeeData.Error!.Contains("Preferred Language"))
		{
			PreferredLanguageMissing = true;
		}
	}
}

public async Task<(Employee? Employee, string? Error)> 
	GetEmployee(string? oid)
{
	if (oid == null) return (null, "OID not defined");

	var photo = string.Empty;
	try
	{
		photo = await GetGraphApiProfilePhoto(oid);
	}
	catch (Exception)
	{
		return (null, "User MUST have a photo...");
	}

	var user =  await _graphServiceClient.Users[oid]
		.GetAsync((requestConfiguration) =>
		{
			requestConfiguration.QueryParameters.Select = new string[] { 
				"id", "givenName", "surname", "jobTitle", "displayName",
				"mail",  "employeeId", "employeeType", "otherMails",
				"mobilePhone", "accountEnabled", "photo", "preferredLanguage",
				"userPrincipalName", "identities"};
			requestConfiguration.Headers.Add("ConsistencyLevel", "eventual");
		});

	if (user!.PreferredLanguage == null)
	{
		return (null, "No Preferred Language defined...");
	}

	if (user!.JobTitle == null)
	{
		return (null, "No JobTitle defined...");
	}

	if (user!.Surname == null)
	{
		return (null, "No Surname defined for the user, add this please");
	}

	if (user!.GivenName == null)
	{
		return (null, "No GivenName defined for the user, add this please");
	}

	if (user!.DisplayName == null)
	{
		return (null, "No DisplayName defined...");
	}

	if (user!.UserPrincipalName == null)
	{
		return (null, "No UserPrincipalName defined...");
	}

	var employee = new Employee
	{
		DisplayName = user.DisplayName,
		GivenName = user.GivenName,
		JobTitle = user.JobTitle,
		Surname = user.Surname,
		PreferredLanguage = user.PreferredLanguage,
		RevocationId = user.UserPrincipalName,
		Photo = photo,
		AccountEnabled = user.AccountEnabled.GetValueOrDefault()
	};

	if (user.Mail != null)
	{
		employee.Mail = user.Mail;
	}
	else
	{
		var otherMail = user.OtherMails!.FirstOrDefault();
		if (otherMail != null)
		{
			employee.Mail = otherMail;
		}
		else
		{
			var validEmail = IsEmailValid(user.UserPrincipalName);
			if (validEmail)
			{
				employee.Mail = user.UserPrincipalName;
			}
			else
			{
				return (null, "No Mail defined...");
			}
		}
	}

	return (employee, null);
}

public async Task<string> GetGraphApiProfilePhoto(string oid)
{
    var photo = string.Empty;
    byte[] photoByte;

    var streamPhoto = new MemoryStream();
    using (var photoStream = await _graphServiceClient.Users[oid].Photo
        .Content.GetAsync())
    {
        photoStream!.CopyTo(streamPhoto);
        photoByte = streamPhoto!.ToArray();
    }

    using var imageFromFile = new MagickImage(photoByte);
    // Sets the output format to jpeg
    imageFromFile.Format = MagickFormat.Jpeg;
    var size = new MagickGeometry(400, 400);

    // This will resize the image to a fixed size without maintaining the aspect ratio.
    // Normally an image will be resized to fit inside the specified size.
    //size.IgnoreAspectRatio = true;

    imageFromFile.Resize(size);

    // Create byte array that contains a jpeg file
    var data = imageFromFile.ToByteArray();
    photo = Base64UrlEncoder.Encode(data);

    return photo;
}

var payload = await _issuerService.GetIssuanceRequestPayloadAsync(Request);

var (Token, Error, ErrorDescription) = await _issuerService.GetAccessToken();

if (string.IsNullOrEmpty(Token))
{
	_log.LogError("failed to acquire accesstoken: {Error} : {ErrorDescription}", Error, ErrorDescription);
	return BadRequest(new { error = Error, error_description = ErrorDescription });
}

var defaultRequestHeaders = _httpClient.DefaultRequestHeaders;
defaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", Token);

var res = await _httpClient.PostAsJsonAsync(_credentialSettings.Endpoint, payload);
var response = await res.Content.ReadFromJsonAsync<IssuanceResponse>();

if (response == null)
	return BadRequest(new { error = "400", error_description = "no response from VC API" });

if (res.StatusCode == HttpStatusCode.Created)
{
	_log.LogTrace("succesfully called Request API");

	if (payload.Pin.Value != null)
	{
		response.Pin = payload.Pin.Value;
	}

	response.Id = payload.Callback.State;

	var cacheData = new CacheData
	{
		Status = IssuanceConst.NotScanned,
		Message = "Request ready, please scan with Authenticator",
		Expiry = response.Expiry.ToString(CultureInfo.InvariantCulture)
	};
	CacheData.AddToCache(payload.Callback.State, _distributedCache, cacheData);

	return Ok(response);
}
else
{
	var message = await res.Content.ReadAsStringAsync();

	_log.LogError("Unsuccesfully called Request API {message}", message);
	return BadRequest(new { error = "400", error_description = "Something went wrong calling the API: " + response });
}

public async Task<IssuanceRequestPayload> 
	GetIssuanceRequestPayloadAsync(HttpRequest request)
{
	var payload = new IssuanceRequestPayload();

	var length = 4;
	var pinMaxValue = (int)Math.Pow(10, length) - 1;
	var randomNumber = RandomNumberGenerator.GetInt32(1, pinMaxValue);
	var newpin = string.Format(CultureInfo.InvariantCulture,
		"{0:D" + length.ToString(CultureInfo.InvariantCulture) + "}", 
		randomNumber);

	payload.Pin.Length = length;
	payload.Pin.Value = newpin;

	payload.CredentialsType = "VerifiedEmployee";

	payload.Manifest = $"{_credentialSettings
		.CredentialManifest}{"?manifestType=claimInjection"}";

	var host = GetRequestHostName(request);
	payload.Callback.State = Guid.NewGuid().ToString();
	payload.Callback.Url = $"{host}/api/issuer/issuanceCallback";
	payload.Callback.Headers.ApiKey = _credentialSettings.VcApiCallbackApiKey;

	payload.Registration.ClientName = "Verifiable Credential Employee";
	payload.Authority = _credentialSettings.IssuerAuthority;

	var oid = request.HttpContext.User
		.Claims.FirstOrDefault(t => t.Type == Consts.OID_TYPE);
	
	var (Employee, Error) = await _microsoftGraphDelegatedClient
		.GetEmployee(oid!.Value);

	if (Employee != null)
	{
		payload.Claims.GivenName = Employee.GivenName;
		payload.Claims.Surname = Employee.Surname;
		payload.Claims.Mail = Employee.Mail;
		payload.Claims.JobTitle = Employee.JobTitle;
		payload.Claims.Photo = Employee.Photo;
		payload.Claims.DisplayName = Employee.DisplayName;
		payload.Claims.PreferredLanguage = Employee.PreferredLanguage;
		payload.Claims.RevocationId = Employee.RevocationId;

		return payload;
	}

	throw new ArgumentNullException(nameof(Employee));
}

[HttpGet("/api/issuer/issuance-response")]
public ActionResult IssuanceResponse()
{
	try
	{
		string? state = Request.Query["id"];
		if (state == null)
		{
			return BadRequest(new { error = "400", 
				error_description = "Missing argument 'id'" });
		}

		var data = CacheData.GetFromCache(state, _distributedCache);
		if (data != null)
		{
			Debug.WriteLine("check if there was a response yet: " + data);
			return new ContentResult
			{
				ContentType = "application/json",
				Content = JsonSerializer.Serialize(data)
			};
		}

		return Ok();
	}
	catch (Exception ex)
	{
		return BadRequest(new { error = "400",
			error_description = ex.Message });
	}
}

[AllowAnonymous]
[HttpPost("/api/issuer/issuanceCallback")]
public async Task<ActionResult> IssuanceCallback()
{
	var content = await new StreamReader(Request.Body)
		.ReadToEndAsync();
	var issuanceResponse = JsonSerializer
		.Deserialize<IssuanceCallbackResponse>(content);

	if (issuanceResponse?.RequestStatus 
		== IssuanceConst.RequestRetrieved)
	{
		var cacheData = new CacheData
		{
			Status = IssuanceConst.RequestRetrieved,
			Message = "QR Code is scanned. Waiting for issuance...",
		};
		CacheData.AddToCache(issuanceResponse.State, 
			_distributedCache, cacheData);
	}

	if (issuanceResponse?.RequestStatus 
		== IssuanceConst.IssuanceSuccessful)
	{
		var cacheData = new CacheData
		{
			Status = IssuanceConst.IssuanceSuccessful,
			Message = "Credential successfully issued",
		};
		CacheData.AddToCache(issuanceResponse.State, 
			_distributedCache, cacheData);
	}

	if (issuanceResponse?.RequestStatus 
		== IssuanceConst.IssuanceError)
	{
		var cacheData = new CacheData
		{
			Status = IssuanceConst.IssuanceError,
			Payload = issuanceResponse.Error?.Code,
			Message = issuanceResponse.Error?.Message
		};
		CacheData.AddToCache(issuanceResponse.State, 
			_distributedCache, cacheData);
	}

	return Ok();