const jwt = require('jsonwebtoken');

// Make sure your secret key is securely loaded from environment variables
// and is a strong, random string. Do NOT hardcode in production.
const JWT_SECRET = process.env.JWT_SECRET || 'supersecretkey_replace_me_in_prod';

function verifyJwtToken(token) {
    return new Promise((resolve, reject) => {
        if (!token) {
            return reject(new Error('No token provided.'));
        }

        jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }, (err, decoded) => {
            if (err) {
                // Handle specific errors for better debugging/response
                if (err.name === 'TokenExpiredError') {
                    return reject(new Error('Token expired.'));
                }
                if (err.name === 'JsonWebTokenError') {
                    return reject(new Error('Invalid token.'));
                }
                return reject(err);
            }
            // Decoded payload includes user information and claims
            resolve(decoded);
        });
    });
}

// Example Usage (in an Express middleware or route handler):
/*
async function authenticateToken(req, res, next) {
    const authHeader = req.headers['authorization'];
    const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN

    try {
        const user = await verifyJwtToken(token);
        req.user = user; // Attach user info to request
        next();
    } catch (error) {
        console.error('JWT verification error:', error.message);
        return res.status(401).json({ message: error.message });
    }
}

// router.get('/protected', authenticateToken, (req, res) => {
//     res.json({ message: 'Access granted!', user: req.user });
// });
*/