BaseController.php

<?php

namespace App\Controllers;

use CodeIgniter\RESTful\ResourceController;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

class BaseController extends ResourceController
{
    protected $format = 'json';

    protected function getJWTSecret(): string
    {
        return getenv('app.JWT_SECRET') ?: 'dev_secret_change_me';
    }

    protected function getJWTExpireMinutes(): int
    {
        return (int)(getenv('app.JWT_EXPIRES_MIN') ?: 1440);
    }

    protected function makeToken(array $payload): string
    {
        $now = time();
        $exp = $now + ($this->getJWTExpireMinutes() * 60);
        $data = array_merge($payload, ['iat' => $now, 'exp' => $exp]);
        return JWT::encode($data, $this->getJWTSecret(), 'HS256');
    }

    protected function getUserFromToken()
    {
        $auth = $this->request->getHeaderLine('Authorization');
        if (!$auth || stripos($auth, 'Bearer ') !== 0) {
            return null;
        }
        $token = trim(substr($auth, 7));
        try {
            $decoded = JWT::decode($token, new Key($this->getJWTSecret(), 'HS256'));
            return (array)$decoded;
        } catch (\Throwable $e) {
            return null;
        }
    }

    protected function requireAuth()
    {
        $user = $this->getUserFromToken();
        if (!$user) {
            return $this->failUnauthorized('Invalid or missing token.');
        }
        return $user;
    }
}