// Short-lived access tokens. Refresh tokens are opaque and handled in routes/auth.js.
import jwt from 'jsonwebtoken';
import { config } from '../config.js';

export function signAccessToken(user) {
  return jwt.sign(
    { sub: user.id, email: user.email, role: user.role },
    config.jwtAccessSecret,
    { expiresIn: config.accessTtlSec }
  );
}

export function verifyAccessToken(token) {
  return jwt.verify(token, config.jwtAccessSecret);
}
