/*
 * Libre WebUI
 * Copyright (C) 2025 Kroonen AI, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
import jwt from 'jsonwebtoken';
import { JWT_SECRET } from '../services/authService.js';
/**
 * Generate a JWT token for a user
 * @param user - User object
 * @returns string - JWT token
 */
export function generateToken(user) {
    const payload = {
        userId: user.id,
        username: user.username,
        email: user.email,
        role: user.role,
    };
    const expiresIn = process.env.JWT_EXPIRES_IN || '7d';
    return jwt.sign(payload, JWT_SECRET, { expiresIn });
}
/**
 * Verify and decode a JWT token
 * @param token - JWT token string
 * @returns JWTPayload - Decoded payload
 */
export function verifyToken(token) {
    try {
        const decoded = jwt.verify(token, JWT_SECRET);
        return decoded;
    }
    catch (error) {
        if (error instanceof jwt.TokenExpiredError) {
            throw new Error('Token has expired');
        }
        else if (error instanceof jwt.JsonWebTokenError) {
            throw new Error('Invalid token');
        }
        else {
            throw new Error('Token verification failed');
        }
    }
}
/**
 * Generate a refresh token (longer expiry)
 * @param user - User object
 * @returns string - Refresh token
 */
export function generateRefreshToken(user) {
    const payload = {
        userId: user.id,
        username: user.username,
        email: user.email,
        role: user.role,
    };
    // Refresh tokens have longer expiry (30 days)
    return jwt.sign(payload, JWT_SECRET, { expiresIn: '30d' });
}
/**
 * Extract token from Authorization header
 * @param authHeader - Authorization header value
 * @returns string | null - Token or null if not found
 */
export function extractTokenFromHeader(authHeader) {
    if (!authHeader) {
        return null;
    }
    const parts = authHeader.split(' ');
    if (parts.length !== 2 || parts[0] !== 'Bearer') {
        return null;
    }
    return parts[1];
}
//# sourceMappingURL=jwt.js.map