const jwt = require("jsonwebtoken");

const secret = () => {
  if (!process.env.JWT_SECRET || process.env.JWT_SECRET.length < 32) throw new Error("JWT_SECRET is not configured securely");
  return process.env.JWT_SECRET;
};

const generateToken = ({ userId, sessionId, tokenVersion }) => jwt.sign(
  { sid: sessionId, tokenVersion },
  secret(),
  {
    algorithm: "HS256",
    subject: userId,
    issuer: process.env.JWT_ISSUER || "zumri-api",
    audience: process.env.JWT_AUDIENCE || "zumri-clients",
    expiresIn: process.env.ACCESS_TOKEN_TTL || "15m",
  },
);

const verifyToken = (token) => jwt.verify(token, secret(), {
  algorithms: ["HS256"],
  issuer: process.env.JWT_ISSUER || "zumri-api",
  audience: process.env.JWT_AUDIENCE || "zumri-clients",
});

module.exports = { generateToken, verifyToken };