JWT Tokens

// npm install jsonwebtoken
const jwt = require("jsonwebtoken");

const SECRET = process.env.JWT_SECRET; // strong random string

// Token generate karo (login par)
function generateTokens(userId) {
  const accessToken = jwt.sign(
    { userId, type: "access" },
    SECRET,
    { expiresIn: "15m" } // short lived
  );
  
  const refreshToken = jwt.sign(
    { userId, type: "refresh" },
    SECRET,
    { expiresIn: "7d" } // long lived
  );
  
  return { accessToken, refreshToken };
}

// Token verify karo
function verifyToken(token) {
  try {
    return jwt.verify(token, SECRET);
  } catch (err) {
    if (err.name === "TokenExpiredError") {
      throw new Error("Token expired — please refresh");
    }
    throw new Error("Invalid token");
  }
}

// Auth middleware
function protect(req, res, next) {
  const token = req.headers.authorization?.split(" ")[1];
  if (!token) return res.status(401).json({ error: "No token" });
  
  try {
    req.user = verifyToken(token);
    next();
  } catch (err) {
    res.status(401).json({ error: err.message });
  }
}