// Auto-generated by create-backlist on <%= new Date().toISOString() %>
import { Request, Response, NextFunction } from 'express';
import jwt, { JwtPayload } from 'jsonwebtoken';

type AuthUser = {
  id: string;
  email?: string;
  role?: string;
};

interface AuthRequest extends Request {
  user?: AuthUser;
}

function getTokenFromRequest(req: Request): string | null {
  // 1) Standard: Authorization: Bearer <token>
  const authHeader = req.headers.authorization;
  if (authHeader && typeof authHeader === 'string') {
    const [type, token] = authHeader.split(' ');
    if (type?.toLowerCase() === 'bearer' && token) return token.trim();
  }

  // 2) Fallback: x-auth-token (your old way)
  const xToken = req.header('x-auth-token');
  if (xToken) return xToken.trim();

  return null;
}

export const protect = (req: AuthRequest, res: Response, next: NextFunction) => {
  const token = getTokenFromRequest(req);

  if (!token) {
    return res.status(401).json({ message: 'Authorization token missing' });
  }

  const secret = process.env.JWT_SECRET;
  if (!secret) {
    // server misconfiguration
    return res.status(500).json({ message: 'JWT_SECRET is not configured' });
  }

  try {
    const decoded = jwt.verify(token, secret) as JwtPayload;

    // Expect payload shape: { user: { id: "..." } }
    const user = (decoded as any).user;

    if (!user?.id) {
      return res.status(401).json({ message: 'Token payload is invalid' });
    }

    req.user = { id: String(user.id), email: user.email, role: user.role };
    return next();
  } catch {
    return res.status(401).json({ message: 'Token is not valid' });
  }
};