RESTful API v2 + JWT

private function generateJwt(array $payload): string
{
    $header  = $this->b64UrlEncode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
    $payload = $this->b64UrlEncode(json_encode(array_merge($payload, [
        'iat' => time(),
        'exp' => time() + 3600,  // 1시간 후 만료
    ])));
    $sig = $this->b64UrlEncode(
        hash_hmac('sha256', "{$header}.{$payload}", $this->jwtSecret, true)
    );
    return "{$header}.{$payload}.{$sig}";
}

private function b64UrlEncode(string $data): string
{
    return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}

private function verifyJwt(string $token): ?array
{
    $parts = explode('.', $token);
    if (count($parts) !== 3) return null;
    [$header, $payload, $sig] = $parts;

    $expected = $this->b64UrlEncode(
        hash_hmac('sha256', "{$header}.{$payload}", $this->jwtSecret, true)
    );
    // Timing-safe 비교!
    if (! hash_equals($expected, $sig)) return null;

    $data = json_decode($this->b64UrlDecode($payload), true);
    if ($data['exp'] < time()) return null;  // 만료 체크
    return $data;
}

private function getAuthenticatedUser(): ?array
{
    $auth = $this->request->getHeaderLine('Authorization');
    if (! str_starts_with($auth, 'Bearer ')) return null;
    return $this->verifyJwt(substr($auth, 7));
}

public function token()
{
    $user = $this->users->findByEmail($email);
    if (! $user || ! password_verify($password, $user->password)) {
        return $this->response->setStatusCode(401)->setJSON([
            'success' => false,
            'message' => '이메일 또는 비밀번호가 올바르지 않습니다.',
        ]);
    }

    $token = $this->generateJwt([
        'sub'      => $user->id,
        'username' => $user->username,
        'email'    => $user->email,
    ]);

    return $this->response->setJSON([
        'token_type' => 'Bearer',
        'token'      => $token,
        'expires_in' => 3600,
    ]);
}

// fetch API
const res = await fetch('/examples/apiv2/users', {
    headers: {
        'Authorization': 'Bearer ' + token,
        'Content-Type':  'application/json',
    },
});
const data = await res.json();

// 또는 axios
axios.get('/examples/apiv2/users', {
    headers: { Authorization: `Bearer ${token}` }
});

// 또는 curl
// curl -H "Authorization: Bearer eyJhbGciOi..." /examples/apiv2/users