import jwt from "jsonwebtoken";

// Get JWT secret from environment or use fallback
const JWT_SECRET =
  process.env.NEXTAUTH_SECRET ||
  process.env.JWT_SECRET ||
  "your-fallback-secret-should-be-at-least-32-chars";

// Create a new JWT token
export function createToken(payload) {
  // Check if payload already has an expiration date set
  const options = payload.exp ? {} : { expiresIn: "30d" };
  
  return jwt.sign(payload, JWT_SECRET, options);
}

// Verify a JWT token
export function verifyToken(token) {
  try {
    if (!token) {
      console.error("No token provided");
      return null;
    }

    console.log("Verifying token:", token.substring(0, 10) + "...");

    const decoded = jwt.verify(token, JWT_SECRET);

    // Validate that we have the minimum required fields
    if (!decoded.sub && !decoded.id) {
      console.error("Token missing required user identifier");
      return null;
    }

    // Log successful token verification with user ID
    console.log(
      "Token verified successfully for user:",
      decoded.sub || decoded.id
    );

    return decoded;
  } catch (error) {
    // Provide detailed error logs
    if (error.name === "TokenExpiredError") {
      console.error("Token expired at:", error.expiredAt);
    } else if (error.name === "JsonWebTokenError") {
      console.error("Invalid token:", error.message);
    } else {
      console.error("Token verification error:", error.message);
    }
    return null;
  }
}

export { JWT_SECRET };