JWT authentication
for the post-quantum era

import { generateKeyPair, sign, verify } from '@pq-jwt/core';

// Generate once — store in your secrets manager
const { publicKey, secretKey } = generateKeyPair('ML-DSA-65');

// Sign a token — identical to jsonwebtoken API
const token = sign(
  { sub: 'user_42', role: 'admin', org: 'acme' },
  secretKey,
  {
    algorithm:  'ML-DSA-65',   // NIST FIPS 204
    expiresIn:  '1h',
    notBefore:  '0s',          // v1.0.6
    issuer:     'auth.myapp.com',
    audience:   'api.myapp.com',
  }
);

// Verify — throws TypedError on failure
const { payload } = verify(token, publicKey, {
  issuer:          'auth.myapp.com',
  audience:        'api.myapp.com',
  clockTolerance:  10,   // distributed system clock skew
});

console.log(payload.sub);   // 'user_42'
console.log(payload.role);  // 'admin'

import {
  verify, importKey,
  TokenExpiredError, SignatureError, InvalidTokenError,
} from '@pq-jwt/core';

const PK = importKey(process.env.PQ_PUBLIC_KEY!);

export function pqAuth(req, res, next) {
  const token = req.headers.authorization?.slice(7);
  if (!token) return res.status(401).json({ error: 'Missing token' });

  try {
    const { payload } = verify(token, PK, {
      issuer: 'auth.myapp.com',
      clockTolerance: 10,
    });
    req.user = payload;
    next();
  } catch (e) {
    if (e instanceof TokenExpiredError) return res.status(401).json({ error: 'Expired' });
    if (e instanceof SignatureError)    return res.status(403).json({ error: 'Invalid' });
    res.status(400).json({ error: e.message });
  }
}