Decrypt decrypts the base64-encoded cipher text using AES-GCM with the given key.

Check if passwords match.

Encrypt plain text using AES-GCM.

GenerateJWTToken generates a short-lived access token (e.g., 15 minutes).

GenerateRefreshToken generates a long-lived refresh token (e.g., 7 days).

handleSpotifyError centralizes error handling for Spotify API calls.

Hash password.

RefreshAccessToken uses the refresh token to generate a new access token.

ValidateJWTToken validates the access token.

ValidateRefreshToken validates the refresh token and returns the claims if valid.

Refresh token secret key.

Claims structure for both access and refresh tokens.