import { NextFunction, Request, Response } from 'express';
import jwt from 'jsonwebtoken';
import { config } from '../config';
import { prisma } from '../db';
import { AuthUser } from '../lib/rbac';
import { unauthorized, forbidden } from '../lib/errors';

export type AuthedRequest = Request & { user?: AuthUser };

type JwtPayload = { sub: string };

export async function requireAuth(req: AuthedRequest, _res: Response, next: NextFunction) {
  try {
    const header = req.headers.authorization;
    if (!header?.startsWith('Bearer ')) throw unauthorized();
    const token = header.slice(7);
    let payload: JwtPayload;
    try {
      payload = jwt.verify(token, config.jwtSecret) as JwtPayload;
    } catch {
      throw unauthorized('Invalid or expired token');
    }
    const emp = await prisma.employee.findUnique({ where: { id: payload.sub } });
    if (!emp || !emp.active) throw unauthorized('Account inactive or not found');
    req.user = {
      id: emp.id,
      code: emp.code,
      name: emp.name,
      email: emp.email,
      role: emp.role,
      active: emp.active,
    };
    next();
  } catch (err) {
    next(err);
  }
}

export function requireSuperAdmin(req: AuthedRequest, _res: Response, next: NextFunction) {
  if (!req.user) return next(unauthorized());
  if (req.user.role !== 'SuperAdmin') {
    return next(forbidden('Super Admin only'));
  }
  next();
}