const jwt = require("jsonwebtoken");
const crypto = require("crypto");
const { env } = require("../config/env");

function signAccessToken(user) {
  return jwt.sign(
    { sub: user._id.toString(), role: user.role, tokenVersion: user.tokenVersion },
    env.jwtAccessSecret,
    { expiresIn: env.jwtAccessExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
  );
}

function signRefreshToken(user) {
  // A random jti lets us revoke a single refresh token (e.g. on logout /
  // password change) without invalidating every session at once.
  const jti = crypto.randomUUID();
  const token = jwt.sign(
    { sub: user._id.toString(), tokenVersion: user.tokenVersion, jti },
    env.jwtRefreshSecret,
    { expiresIn: env.jwtRefreshExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
  );
  return { token, jti };
}

function verifyAccessToken(token) {
  return jwt.verify(token, env.jwtAccessSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
}

function verifyRefreshToken(token) {
  return jwt.verify(token, env.jwtRefreshSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
}

module.exports = { signAccessToken, signRefreshToken, verifyAccessToken, verifyRefreshToken };