import jwt from 'jsonwebtoken'

const JWT_SECRET = process.env.JWT_SECRET || 'super-secret-jwt-token-for-calctext-local-dev-only'

interface JWTPayload {
  sub: string
  email?: string
  role?: string
  exp?: number
  iat?: number
}

/**
 * Verify a Supabase JWT token.
 * Returns the decoded payload or null if invalid.
 */
export function verifyToken(token: string): JWTPayload | null {
  try {
    const decoded = jwt.verify(token, JWT_SECRET) as JWTPayload
    return decoded
  } catch {
    return null
  }
}
