認證與授權：JWT、OAuth2、Session
Cookie vs Token、Refresh Token、第三方登入

import jwt from 'jsonwebtoken';

const SECRET = process.env.JWT_SECRET!;  // 至少 32 字元的隨機字串

// ── 登入時：簽發 JWT ──────────────────────────────
async function login(email: string, password: string) {
    const user = await db.user.findUnique({ where: { email } });
    if (!user || !await bcrypt.compare(password, user.hashedPassword)) {
        throw new Error('Invalid credentials');
    }

    const accessToken = jwt.sign(
        { userId: user.id, email: user.email },
        SECRET,
        { expiresIn: '15m' }   // Access Token 短存活期（15 分鐘）
    );

    const refreshToken = jwt.sign(
        { userId: user.id },
        SECRET,
        { expiresIn: '7d' }    // Refresh Token 長存活期（7 天）
    );

    // Refresh Token 存在 HttpOnly Cookie（更安全）
    // Access Token 存在記憶體或 localStorage
    return { accessToken, refreshToken };
}

// ── 每次請求：驗證 JWT ────────────────────────────
function authenticate(req: Request) {
    const authHeader = req.headers.get('Authorization');
    const token = authHeader?.replace('Bearer ', '');
    if (!token) throw new Error('No token');

    try {
        const payload = jwt.verify(token, SECRET) as { userId: number };
        return payload.userId;
    } catch (err) {
        throw new Error('Invalid or expired token');
    }
}

// ── Access Token 過期時：用 Refresh Token 換新的 ──
async function refreshAccessToken(refreshToken: string) {
    const payload = jwt.verify(refreshToken, SECRET) as { userId: number };
    const newAccessToken = jwt.sign({ userId: payload.userId }, SECRET, { expiresIn: '15m' });
    return newAccessToken;
}

// app/api/auth/[...nextauth]/route.ts
import NextAuth from 'next-auth';
import GoogleProvider from 'next-auth/providers/google';

const handler = NextAuth({
    providers: [
        GoogleProvider({
            clientId: process.env.GOOGLE_CLIENT_ID!,
            clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
        }),
    ],
    callbacks: {
        async jwt({ token, account, profile }) {
            // 第一次登入時，account 有 Google 回傳的資料
            if (account && profile) {
                token.userId = await findOrCreateUser(profile.email, profile.name);
            }
            return token;
        },
        async session({ session, token }) {
            session.userId = token.userId;  // 把 userId 帶進 session
            return session;
        },
    },
});

export { handler as GET, handler as POST };

// ── 在組件中使用 ──────────────────────────────────
// 'use client'
import { useSession, signIn, signOut } from 'next-auth/react';

export function AuthButton() {
    const { data: session } = useSession();
    if (session) {
        return <button onClick={() => signOut()}>登出 {session.user?.name}</button>;
    }
    return <button onClick={() => signIn('google')}>用 Google 登入</button>;
}