import { NextFunction, Request, Response } from "express";
import jwt from "jsonwebtoken";
import { UserRole } from "../types/types";

declare global {
  namespace Express {
    interface Request {
      user?: any;
    }
  }
}

function extractToken(req: Request): string | null {
  const authHeader = req.headers.authorization;
  if (authHeader?.startsWith("Bearer ")) {
    return authHeader.slice("Bearer ".length).trim();
  }
  const legacyHeader = req.headers["x-auth-token"];
  if (typeof legacyHeader === "string" && legacyHeader) {
    return legacyHeader;
  }
  return null;
}

export function requireAuth(req: Request, res: Response, next: NextFunction) {
  const token = extractToken(req);
  if (!token) {
    return res.status(401).json({ message: "Authentication required" });
  }

  if (!process.env.JWT_SECRET) {
    console.error("JWT_SECRET is not set");
    return res.status(500).json({ message: "Server configuration error" });
  }

  jwt.verify(token, process.env.JWT_SECRET, (err, decoded: any) => {
    if (err || !decoded?.user) {
      return res.status(401).json({ message: "Invalid or expired token" });
    }
    req.user = decoded.user;
    next();
  });
}

export function requireAdmin(req: Request, res: Response, next: NextFunction) {
  requireAuth(req, res, () => {
    if (req.user?.role !== UserRole.admin) {
      return res.status(403).json({ message: "Admin access required" });
    }
    next();
  });
}