import * as jose from 'jose';
import type { EventerSession } from './types';

const SESSION_TTL_SECONDS = 60 * 60; // 1 hour, per R3 in auth-requirements.md

export async function createSessionToken(session: EventerSession, secret: Uint8Array): Promise<string> {
  return new jose.SignJWT({ username: session.username, email: session.email })
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime(`${SESSION_TTL_SECONDS}s`)
    .sign(secret);
}

export async function verifySessionToken(token: string, secret: Uint8Array): Promise<EventerSession | null> {
  try {
    const { payload } = await jose.jwtVerify(token, secret);
    if (typeof payload.username !== 'string') {
      return null;
    }
    return {
      username: payload.username,
      email: typeof payload.email === 'string' ? payload.email : undefined,
    };
  } catch {
    return null;
  }
}