import { SignJWT, jwtVerify } from "jose";

const encoder = new TextEncoder();
const issuer = "etqan-gateway";

function getSecret() {
  const value = process.env.JWT_SECRET;
  if (!value) throw new Error("إعدادات جلسة الهاتف غير متوفرة");
  return encoder.encode(value);
}

export async function createPhoneSession(phone: string) {
  return new SignJWT({ phone, type: "phone-session" })
    .setProtectedHeader({ alg: "HS256" })
    .setIssuer(issuer)
    .setSubject(phone)
    .setIssuedAt()
    .setExpirationTime("30d")
    .sign(getSecret());
}

export async function verifyPhoneSession(token: string) {
  const { payload } = await jwtVerify(token, getSecret(), { issuer });
  if (payload.type !== "phone-session" || typeof payload.phone !== "string") throw new Error("جلسة الهاتف غير صالحة");
  return payload.phone;
}