session-manager.service.ts

import { Injectable, Inject } from '@nestjs/common';
import * as jwt from 'jsonwebtoken';
import { ApiModuleConfig, API_MODULE_CONFIG } from './api.config';

/**
 * Payload structure for session tokens
 */
export interface SessionTokenPayload {
  identifier: string;
  authMethod: 'passkey' | 'mediation' | 'otp';
}

/**
 * Result of session token verification
 */
export interface VerifySessionTokenResult {
  valid: boolean;
  payload?: SessionTokenPayload;
  error?: string;
}

/**
 * SessionManagerService - Handles session token generation and verification
 *
 * See README.md for more details.
 */
@Injectable()
export class SessionManagerService {
  private readonly secret: string;
  private readonly expiresIn: number;

  constructor(@Inject(API_MODULE_CONFIG) config: ApiModuleConfig) {
    this.secret = config.jwtSecret;
    this.expiresIn = config.sessionTokenExpirySeconds || 60 * 60 * 12; // 12 hours
  }

  /**
   * Generate a signed session token after successful authentication
   *
   * This token proves the user authenticated.
   *
   * @param identifier - Your application's user identifier
   * @param authMethod - How the user authenticated ('passkey', 'mediation', or 'otp')
   * @returns Signed JWT session token
   */
  generateSessionToken(
    identifier: string,
    authMethod: 'passkey' | 'mediation' | 'otp',
  ): string {
    const payload: SessionTokenPayload = {
      identifier,
      authMethod,
    };

    return jwt.sign(payload, this.secret, {
      expiresIn: this.expiresIn,
      issuer: 'custom-api',
      subject: identifier,
    });
  }

  /**
   * Verify a session token
   *
   * @param token - The session token to verify
   * @returns Verification result with payload if valid
   */
  verifySessionToken(token: string): VerifySessionTokenResult {
    try {
      const payload = jwt.verify(token, this.secret, {
        issuer: 'custom-api',
      }) as SessionTokenPayload;

      return {
        valid: true,
        payload: {
          identifier: payload.identifier,
          authMethod: payload.authMethod,
        },
      };
    } catch (error) {
      if (error instanceof jwt.TokenExpiredError) {
        return {
          valid: false,
          error: 'Token expired',
        };
      }
      if (error instanceof jwt.JsonWebTokenError) {
        return {
          valid: false,
          error: 'Invalid token',
        };
      }
      return {
        valid: false,
        error: 'Token verification failed',
      };
    }
  }
}