{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "42",
    "jti": "e4f1a3b0-1234-5678-9abc-def012345678",
    "role": "CANDIDAT",
    "email": "jean@example.com",
    "iat": 1713454200,
    "exp": 1713455100,
    "iss": "thehive"
  }
}

class TokenManager {
  constructor() {
    this.access = null;
    this.refresh = localStorage.getItem('refresh');
    this.refreshing = null;
  }

  async getValidAccess() {
    if (this.access && !this.isExpired(this.access)) return this.access;
    if (!this.refreshing) this.refreshing = this.doRefresh();
    return this.refreshing;
  }

  async doRefresh() {
    const res = await fetch('/v1/api/auth/refresh-token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ refreshToken: this.refresh }),
    });
    if (!res.ok) { this.logout(); throw new Error('Refresh failed'); }
    const { accessToken, refreshToken } = await res.json();
    this.access = accessToken;
    this.refresh = refreshToken;
    localStorage.setItem('refresh', refreshToken);
    this.refreshing = null;
    return accessToken;
  }

  isExpired(token) {
    const { exp } = JSON.parse(atob(token.split('.')[1]));
    return Date.now() >= (exp - 30) * 1000;
  }
}