const jwt = require("jsonwebtoken");
const config = require("../config/auth.config");
const {db} = require('../modules/db');
const User = db.user;

verifyToken = (req, res, next) => {
    const token = req.headers["x-access-token"] || req.headers.authorization;

    if (!token) return res.status(403).send({message: "No token provided!"});

    const raw = token.startsWith("Bearer ") ? token.slice(7) : token;
    jwt.verify(raw, config.JWT_SECRET, (err, decoded) => {
        if (err) return res.status(401).send({message: "Unauthorized!",});
        req.userId = decoded.id;
        next();
    });
};

const requireRole = (roleNames) => async (req, res, next) => {
    try {
        if (!req.userId) return res.status(401).send({message: "User ID missing in request."});
        const user = await User.findByPk(req.userId);
        if (!user) return res.status(404).send({message: "User not found."});

        const roles = await user.getRoles();
        const has = roles.some(r => roleNames.includes(r.name));
        if (!has) return res.status(403).send({message: `Require ${roleNames.join(" or ")} Role!`});

        next();
    } catch (err) {
        console.error("Role check error:", err);
        res.status(500).send({message: "Internal server error."});
    }
};

module.exports = {
    verifyToken,
    isAdmin: requireRole(["admin"])
};