import * as jose from "jose";
function getJwtSecret(secret) {
    if (!secret.trim())
        throw new Error("JWT secret is not configured");
    return new TextEncoder().encode(secret);
}
export const AUTH_COOKIE_NAME = "jait_token";
export function extractBearerToken(headerValue) {
    if (typeof headerValue !== "string")
        return null;
    const trimmed = headerValue.trim();
    if (!trimmed.toLowerCase().startsWith("bearer "))
        return null;
    const token = trimmed.slice(7).trim();
    return token || null;
}
export async function signAuthToken(user, jwtSecret) {
    return new jose.SignJWT({ username: user.username })
        .setProtectedHeader({ alg: "HS256", typ: "JWT" })
        .setSubject(user.id)
        .setIssuedAt()
        .setExpirationTime("7d")
        .sign(getJwtSecret(jwtSecret));
}
export async function verifyAuthToken(token, jwtSecret) {
    try {
        const { payload } = await jose.jwtVerify(token, getJwtSecret(jwtSecret));
        const id = typeof payload.sub === "string" ? payload.sub : "";
        const username = typeof payload.username === "string" ? payload.username : "";
        if (!id || !username)
            return null;
        return { id, username };
    }
    catch {
        return null;
    }
}
export async function requireAuth(request, reply, jwtSecret) {
    const token = extractBearerToken(request.headers.authorization)
        ?? (request.cookies?.[AUTH_COOKIE_NAME] || null);
    if (!token) {
        await reply.status(401).send({ detail: "login_required" });
        return null;
    }
    const user = await verifyAuthToken(token, jwtSecret);
    if (!user) {
        await reply.status(401).send({ detail: "login_required" });
        return null;
    }
    return user;
}
//# sourceMappingURL=http-auth.js.map