import { Router } from "express";
import { pool } from "../db/pool.ts";
import { authRequired, err, h, type AuthedRequest } from "../lib/auth.ts";

export const authRouter = Router();

/**
 * Portado tal cual del backend de demo: el token es el id del usuario y la
 * contraseña se compara en claro. Ver la nota de deuda en lib/auth.ts — se
 * endurece entero (hash + sesión real + cliente + pruebas) o no se toca.
 */
authRouter.post(
  "/login",
  h(async (req, res) => {
    const { email, password } = req.body ?? {};
    if (!email || !password) {
      err(res, 400, "Faltan credenciales");
      return;
    }
    const { rows } = await pool.query(
      `SELECT id, business_id, email, name, role, employee_id, avatar_color, password
         FROM users WHERE email = $1`,
      [String(email).toLowerCase().trim()]
    );
    const user = rows[0];
    if (!user || user.password !== password) {
      err(res, 401, "Correo o contraseña incorrectos");
      return;
    }
    const { password: _pw, ...safe } = user;
    res.json({ token: String(user.id), user: safe });
  })
);

authRouter.get("/me", authRequired, (req: AuthedRequest, res) => {
  res.json({ user: req.user });
});

authRouter.get(
  "/demo-users",
  h(async (_req, res) => {
    const { rows } = await pool.query(
      `SELECT email, name, role, avatar_color FROM users
        ORDER BY CASE role WHEN 'admin' THEN 0 WHEN 'owner' THEN 1 ELSE 2 END, name`
    );
    res.json({ users: rows });
  })
);