import { Injectable, UnauthorizedException } from "@nestjs/common";
import jwt from "jsonwebtoken";

export interface AccessTokenClaims {
  sub: string; // userId
}

const ACCESS_TOKEN_TTL_SECONDS = Number(process.env.ACCESS_TOKEN_TTL_SECONDS ?? 15 * 60);

function secret(): string {
  const value = process.env.JWT_ACCESS_SECRET;
  if (!value) {
    // Fails loudly rather than silently signing with a guessable default —
    // acceptable in dev because docker-compose/`.env.example` set this.
    throw new Error("JWT_ACCESS_SECRET is not set");
  }
  return value;
}

@Injectable()
export class JwtService {
  readonly accessTokenTtlSeconds = ACCESS_TOKEN_TTL_SECONDS;

  sign(userId: string | number): string {
    return jwt.sign({ sub: String(userId) } satisfies AccessTokenClaims, secret(), {
      expiresIn: ACCESS_TOKEN_TTL_SECONDS,
    });
  }

  verify(token: string): AccessTokenClaims {
    try {
      return jwt.verify(token, secret()) as AccessTokenClaims;
    } catch {
      throw new UnauthorizedException("invalid or expired access token");
    }
  }
}