nhance/app/Helpers/JWTToken.php

<?php

namespace App\Helpers;


use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Firebase\JWT\ExpiredException;
use Firebase\JWT\BeforeValidException;
use Firebase\JWT\SignatureInvalidException;
// use Psr\Http\Message\RequestInterface;
use CodeIgniter\HTTP\RequestInterface;
use ReflectionClass;
use Exception;
use App\Models\EmployeeModel;
use App\Models\LevelContactModel;


class JWTToken
{

    private const ALLOWED_ALG = 'HS512';

    public static function encode($data =null)
    {
        $secret_Key = env('JWT_SECRET');

        $request_data = (array)$data;

        try{
            $token =  JWT::encode($request_data ,$secret_Key,'HS512');
            $id = $request_data['id'];
            $update["token_time_out"] = time() + getenv('TOKENTIMEOUT');
           
            if(isset($data['emp_code'])){
                $model = new EmployeeModel();
                $model->update($id, $update);
           
            }else{
                $models = new LevelContactModel();
                $id = $request_data['post_hr_id'];
                $models->update($id, $update);

            }
            

            return $token;
        }
        catch (Exception $e) {
            return ['status' => false,'message' => $e->getMessage()];
        }
    }

    // public static function validateJWT($jwt)
    // {
    //         $jwtParts = explode(' ', $jwt);

    //         // print_r($jwtParts);
    //         if (count($jwtParts) != 2 || $jwtParts[0] == 'Bearer') {
    //             return false;
    //         }

    //         $token = $jwtParts[1];

    //         try {
    //             $decoded = JWT::decode($token, new Key(env('JWT_SECRET'), 'HS512'));
    //             return json_encode(['status' => true, 'message' => 'Token is valid', 'decoded' => (array) $decoded]);
    //         } catch (ExpiredException $e) {
    //             return json_encode(['status' => false, 'message' => 'Token has expired']);
    //         } catch (BeforeValidException $e) {
    //             return json_encode(['status' => false, 'message' => 'Token is not yet valid']);
    //         } catch (SignatureInvalidException $e) {
    //             return json_encode(['status' => false, 'message' => 'Token signature is invalid']);
    //         } catch (\Exception $e) {
    //             return json_encode(['status' => false, 'message' => 'An error occurred while decoding the token']);
    //         }           

    // }

    public static function validateJWT(string $authHeader)
    {
        // 1️⃣ Validate Authorization header
        if (!preg_match('/^Bearer\s(\S+)$/', $authHeader, $matches)) {
            return ['status' => false, 'message' => 'Invalid Authorization header'];
        }

        $token = $matches[1];

        // 2️⃣ Decode JWT header manually
        $jwtParts = explode('.', $token);
        if (count($jwtParts) !== 3) {
            return ['status' => false, 'message' => 'Malformed JWT'];
        }

        $header = json_decode(base64_decode(strtr($jwtParts[0], '-_', '+/')), true);

        // 3️⃣ Reject missing or NONE algorithm
        if (
            empty($header['alg']) ||
            $header['alg'] === 'none' ||
            $header['alg'] !== self::ALLOWED_ALG
        ) {
            return ['status' => false, 'message' => 'Invalid or unsupported JWT algorithm'];
        }

        // 4️⃣ Enforce signature validation
        try {
            $decoded = JWT::decode(
                $token,
                new Key(env('JWT_SECRET'), self::ALLOWED_ALG)
            );

            return [
                'status'  => true,
                'decoded' => (array) $decoded
            ];

        } catch (ExpiredException $e) {
            return ['status' => false, 'message' => 'Token expired'];
        } catch (BeforeValidException $e) {
            return ['status' => false, 'message' => 'Token not yet valid'];
        } catch (SignatureInvalidException $e) {
            return ['status' => false, 'message' => 'Invalid token signature'];
        } catch (\Exception $e) {
            return ['status' => false, 'message' => 'Token validation failed'];
        }
    }



    public static function getIdFromToken($jwt)
    {

            $jwtParts = explode(' ', $jwt);

            $token = $jwtParts[0];

            try {
                $decoded = JWT::decode($token, new Key("secret", 'HS512'));
                return json_encode(['status' => true, 'message' => 'Token is valid', 'data' =>$decoded->data->id ]);
            } catch (ExpiredException $e) {
                return json_encode(['status' => false, 'message' => 'Token has expired']);
            } catch (BeforeValidException $e) {
                return json_encode(['status' => false, 'message' => 'Token is not yet valid']);
            } catch (SignatureInvalidException $e) {
                return json_encode(['status' => false, 'message' => 'Token signature is invalid']);
            } catch (\Exception $e) {
                return json_encode(['status' => false, 'message' => 'An error occurred while decoding the token']);
            }           


    }

    public static function getUserIdFromToken()
    {
        $request = \Config\Services::request();
        $jwt = $request->getHeader('Authorization');
        $jwtParts = explode(' ', $jwt);
        $token = $jwtParts[1];    
        
        $decoded = JWT::decode($token, new Key("secret", 'HS512'));
        return $decoded->id;
    }

    public static function getUserRoleFromToken()
    {
        $request = \Config\Services::request();
        $jwt = $request->getHeader('Authorization');
        $jwtParts = explode(' ', $jwt);
        $token = $jwtParts[1];    
        
        $decoded = JWT::decode($token, new Key("secret", 'HS512'));
        return $decoded->role;
    }


    public static function decodeToken()
    {
        $request = \Config\Services::request();
        $jwt = $request->getHeader('Authorization');
        $jwtParts = explode(' ', $jwt);
        $token = $jwtParts[1];    
        
        $decoded = JWT::decode($token, new Key("secret", 'HS512'));
        return $decoded;
    }

}