"""JWT session token service.

⚠️ AUTO-GENERATED BY PRISM - DO NOT EDIT
Creates and verifies cookie-based JWT session tokens.
"""

from __future__ import annotations

from datetime import UTC, datetime, timedelta
from typing import Any

import jwt

from {{ project_name }}.auth.config import auth_settings

SESSION_TOKEN_EXPIRY = timedelta(seconds={{ session_max_age_seconds }})


def create_session_jwt(user: Any) -> str:
    """Create a self-issued JWT session token for a user.

    Args:
        user: User model instance with id, email, and roles attributes.

    Returns:
        HS256 JWT string.
    """
    now = datetime.now(UTC)
    payload: dict[str, Any] = {
        "sub": str(user.id),
        "email": user.email,
        "roles": user.roles or [],
        "iat": now,
        "exp": now + SESSION_TOKEN_EXPIRY,
    }
    return jwt.encode(payload, auth_settings.jwt_secret, algorithm="{{ algorithm }}")


def decode_session_jwt(token: str) -> dict[str, Any]:
    """Decode and validate a self-issued JWT session token.

    Args:
        token: JWT string from the session cookie.

    Returns:
        Decoded claims dict.

    Raises:
        jwt.InvalidTokenError: If the token is invalid or expired.
    """
    return jwt.decode(token, auth_settings.jwt_secret, algorithms=["{{ algorithm }}"])
