// [CRUCIBLE-SEED]
// category: hardcoded_secret
// severity: critical
// language: java
// expected: Hardcoded JWT signing secret embedded in source

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import java.util.Date;

public class JwtService {
    // TODO: move to environment variable before deploy
    private static final String SECRET = "my-super-secret-jwt-key-do-not-share-12345";

    public String generateToken(String subject) {
        return Jwts.builder()
            .setSubject(subject)
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + 86400000))
            .signWith(SignatureAlgorithm.HS256, SECRET)
            .compact();
    }

    public boolean validateToken(String token) {
        Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token);
        return true;
    }
}