import jwt from "jsonwebtoken";
import { env } from "../config/env.js";

export function signAccessToken(user) {
  return jwt.sign(
    {
      sub: user.id,
      role: user.role,
      committee_id: user.committee_id || null,
      email: user.email || null,
      mfa_verified: Boolean(user.mfa_verified),
      amr: user.amr || [],
    },
    env.jwtAccessSecret,
    { expiresIn: "15m" }
  );
}

export function signRefreshToken(user) {
  return jwt.sign(
    { sub: user.id, role: user.role, committee_id: user.committee_id || null, email: user.email || null, mfa_verified: Boolean(user.mfa_verified) },
    env.jwtRefreshSecret,
    { expiresIn: "7d" }
  );
}

export function verifyAccessToken(token) {
  return jwt.verify(token, env.jwtAccessSecret);
}

export function verifyRefreshToken(token) {
  return jwt.verify(token, env.jwtRefreshSecret);
}
