/**
 * Copyright (c) 2026 Niolla
 * All rights reserved.
 *
 * This source code is proprietary and confidential.
 * Unauthorized copying, modification, distribution, or use
 * of this file, via any medium, is strictly prohibited.
 */

// app/utils/jwt.util.js

const jwt = require("jsonwebtoken");
require("dotenv").config();

const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || "15m"; // token validity

const REFRESH_TOKEN_DAYS = process.env.REFRESH_TOKEN_DAYS || "7d"; // refresh token validity

const getSecret = (name) => {
  const value = process.env[name];
  if (!value || value.length < 32) throw new Error(`${name} is not configured securely`);
  return value;
};

/**
 * Generate JWT token
 * @param {Object} payload - usually { id, email, role }
 * @returns string
 */
const generateToken = (payload) => {
  return jwt.sign(payload, getSecret("JWT_SECRET"), { expiresIn: JWT_EXPIRES_IN });
};

/**
 * Verify JWT token
 * @param {string} token
 * @returns payload or throws error
 */
const verifyToken = (token) => {
  return jwt.verify(token, getSecret("JWT_SECRET"));
};

const generateRefreshToken = (payload) => {
  return jwt.sign(payload, getSecret("REFRESH_TOKEN_SECRET"), { expiresIn: REFRESH_TOKEN_DAYS });
}

const verifyRefreshToken = (token) => {
  return jwt.verify(token, getSecret("REFRESH_TOKEN_SECRET"));
}

module.exports = { generateToken, verifyToken, generateRefreshToken, verifyRefreshToken };