ТЗ: Enterprise SaaS-дашборд с Auth, RBAC и HttpOnly JWT сессиями

// lib/auth/session.ts
import { SignJWT, jwtVerify } from 'jose'
import { cookies } from 'next/headers'

export type UserRole = 'admin' | 'manager' | 'member'

export interface SessionPayload {
  userId: string
  email: string
  role: UserRole
  orgId: string
  expiresAt: Date
}

const secretKey = process.env.JWT_SECRET!
const encodedKey = new TextEncoder().encode(secretKey)

export async function encryptSession(payload: SessionPayload): Promise<string> {
  return new SignJWT({ ...payload })
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime('7d')
    .sign(encodedKey)
}

export async function decryptSession(session: string | undefined): Promise<SessionPayload | null> {
  if (!session) return null
  try {
    const { payload } = await jwtVerify(session, encodedKey, {
      algorithms: ['HS256']
    })
    return payload as unknown as SessionPayload
  } catch {
    return null
  }
}

export async function getSession(): Promise<SessionPayload | null> {
  const cookieStore = await cookies()
  const sessionCookie = cookieStore.get('saas_session')?.value
  return decryptSession(sessionCookie)
}