LMS/backend/app/security.py

from datetime import datetime, timedelta, timezone
import os

import bcrypt
from jose import JWTError, jwt

# ── Config (override via environment variables) ───────────────────────────────
_raw_secret = os.getenv("JWT_SECRET_KEY", "")
if not _raw_secret:
    import warnings
    _raw_secret = "lms_dev_jwt_secret_change_in_production"
    warnings.warn(
        "JWT_SECRET_KEY is not set — using insecure default. "