import jwt from 'jsonwebtoken';

function requireSecret(name: string, devFallback: string): string {
  const value = process.env[name];
  if (value && value.length >= 16) return value;
  if (process.env.NODE_ENV === 'production') {
    throw new Error(`${name} must be set to a strong value (>=16 chars) in production`);
  }
  return devFallback;
}

const ACCESS_SECRET = requireSecret('JWT_SECRET', 'dev-access-secret');
const REFRESH_SECRET = requireSecret('JWT_REFRESH_SECRET', 'dev-refresh-secret');

export interface TokenPayload {
  sub: string;
  role: string;
  name: string;
}

export function signAccess(payload: TokenPayload): string {
  return jwt.sign(payload, ACCESS_SECRET, { expiresIn: '15m' });
}

export function signRefresh(payload: TokenPayload): string {
  return jwt.sign(payload, REFRESH_SECRET, { expiresIn: '7d' });
}

export function verifyAccess(token: string): TokenPayload {
  return jwt.verify(token, ACCESS_SECRET) as TokenPayload;
}

export function verifyRefresh(token: string): TokenPayload {
  return jwt.verify(token, REFRESH_SECRET) as TokenPayload;
}