import jwt from 'jsonwebtoken';
import type { Request, Response, NextFunction } from 'express';

export type AuthTokenPayload = {
  id: string;
  role: string;
  email: string;
};

const JWT_SECRET = process.env.JWT_SECRET || 'ahri_super_secret_key_change_in_production';

export function requireAuth(req: Request, res: Response, next: NextFunction) {
  const header = req.headers.authorization;
  if (!header?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Authorization required' });
  }
  const token = header.slice(7);
  try {
    const decoded = jwt.verify(token, JWT_SECRET) as AuthTokenPayload;
    (req as Request & { authUser?: AuthTokenPayload }).authUser = decoded;
    next();
  } catch {
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
}

export function requireSysAdmin(req: Request, res: Response, next: NextFunction) {
  const user = (req as Request & { authUser?: AuthTokenPayload }).authUser;
  if (!user || user.role !== 'SYS_ADMIN') {
    return res.status(403).json({ error: 'Only system administrators can manage meeting rooms.' });
  }
  next();
}

export function requireOfficerOrAdmin(req: Request, res: Response, next: NextFunction) {
  const user = (req as Request & { authUser?: AuthTokenPayload }).authUser;
  if (!user || (user.role !== 'OFFICER' && user.role !== 'SYS_ADMIN')) {
    return res.status(403).json({ error: 'Only officers and system administrators can perform this action.' });
  }
  next();
}