import { SignJWT, jwtVerify, type JWTPayload } from 'jose'

const SESSION_COOKIE = 'ims_session'
const SESSION_TTL_SECONDS = 8 * 60 * 60  // 8 hours

export { SESSION_COOKIE }

function getSecret(): Uint8Array {
  const secret = process.env.JWT_SECRET
  if (!secret) throw new Error('JWT_SECRET not configured')
  return new TextEncoder().encode(secret)
}

export interface SessionPayload {
  sub: string      // user id (UUID)
  role: string     // user_role enum value
  siteId: string | null
  name: string
}

export async function createSession(payload: SessionPayload): Promise<string> {
  return new SignJWT({ ...payload } as JWTPayload)
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime(`${SESSION_TTL_SECONDS}s`)
    .sign(getSecret())
}

/** Verify and decode a JWT. Returns null on invalid/expired. */
export async function verifySession(token: string): Promise<SessionPayload | null> {
  try {
    const { payload } = await jwtVerify(token, getSecret())
    return payload as unknown as SessionPayload
  } catch {
    return null
  }
}