"""
auth.py — token verification for B24 Browser AI backend.

This backend does NOT own user accounts. Accounts live on the messenger
backend (Messenger_back_database). This module only verifies JWTs issued
by that backend, using the same shared secret, so no network round-trip
is needed on every request.
"""

import os
import jwt

JWT_SECRET = os.environ.get("JWT_SECRET", "change-me-in-space-secrets")
JWT_ALGO = "HS256"


def verify_token(token: str):
    try:
        payload = jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGO])
        return payload
    except jwt.ExpiredSignatureError:
        return None
    except jwt.InvalidTokenError:
        return None