Code Agent — msn-0091 / auth refactor

1import { SignJWT, jwtVerify } from 'jose';
2import { nanoid } from 'nanoid';
3import { getSecret } from './secret';
4 
5const SESSION_TTL = 60 * 60 * 24 * 7;
6 
7export async function createSession(userId: string) {
8  const sessionId = nanoid();
9  const token = await new SignJWT({ sub: userId, sid: sessionId })
10    .setProtectedHeader({ alg: 'HS256' })
11    .setExpirationTime(SESSION_TTL + 's')
12    .sign(getSecret());
13  return { sessionId, token };
14}
15 
16export async function verifySession(token: string) {
17  try {
18    const { payload } = await jwtVerify(token, getSecret());
19    return payload;
20  } catch {
21    return null;
verifySession should throw AuthError, not return null
22  }
23}