import jwt, { SignOptions } from 'jsonwebtoken';
import { UserRole, JwtPayload } from '@ehandyhire/shared';
import { AppError } from './utils';

const ACCESS_SECRET = process.env.JWT_ACCESS_SECRET || 'dev-access-secret';
const REFRESH_SECRET = process.env.JWT_REFRESH_SECRET || 'dev-refresh-secret';
const ACCESS_EXPIRES = process.env.JWT_ACCESS_EXPIRES_IN || '15m';
const REFRESH_EXPIRES = process.env.JWT_REFRESH_EXPIRES_IN || '7d';

export function generateAccessToken(userId: string, role: UserRole, email?: string) {
  const options: SignOptions = { expiresIn: ACCESS_EXPIRES as SignOptions['expiresIn'] };
  return jwt.sign({ userId, role, email } as JwtPayload, ACCESS_SECRET, options);
}

export function generateRefreshToken(userId: string, role: UserRole) {
  const options: SignOptions = { expiresIn: REFRESH_EXPIRES as SignOptions['expiresIn'] };
  return jwt.sign({ userId, role } as JwtPayload, REFRESH_SECRET, options);
}

export function verifyAccessToken(token: string): JwtPayload {
  try {
    return jwt.verify(token, ACCESS_SECRET) as JwtPayload;
  } catch {
    throw new AppError('Invalid or expired access token', 401);
  }
}

export function verifyRefreshToken(token: string): JwtPayload {
  try {
    return jwt.verify(token, REFRESH_SECRET) as JwtPayload;
  } catch {
    throw new AppError('Invalid or expired refresh token', 401);
  }
}

export function generateTokens(userId: string, role: UserRole, email?: string) {
  return {
    accessToken: generateAccessToken(userId, role, email),
    refreshToken: generateRefreshToken(userId, role),
  };
}