import type { NextFunction, Request, Response } from "express";

import { HttpError } from "../lib/http-error.js";
import { verifyAccessToken } from "../lib/jwt.js";

export const requireAuth = (request: Request, _response: Response, next: NextFunction) => {
  const header = request.headers.authorization;
  if (!header?.startsWith("Bearer ")) {
    return next(new HttpError(401, "Missing bearer token"));
  }

  try {
    request.user = verifyAccessToken(header.slice(7));
    return next();
  } catch {
    return next(new HttpError(401, "Invalid token"));
  }
};

export const requireRole =
  (role: "admin" | "user") => (request: Request, _response: Response, next: NextFunction) => {
    if (!request.user) {
      return next(new HttpError(401, "Missing authenticated user"));
    }
    if (request.user.role !== role) {
      return next(new HttpError(403, "Insufficient role"));
    }
    return next();
  };