import type { Request, Response, NextFunction } from "express";
import { db } from "../db.ts";
import type { User } from "../../shared/types.ts";

export interface AuthedRequest extends Request {
  user?: User;
}

export function authRequired(req: AuthedRequest, res: Response, next: NextFunction) {
  const header = req.header("authorization") || "";
  const token = header.startsWith("Bearer ") ? header.slice(7) : req.header("x-user-id");
  if (!token) {
    res.status(401).json({ error: "No autorizado" });
    return;
  }
  const userId = Number(token);
  if (!Number.isFinite(userId)) {
    res.status(401).json({ error: "Token inválido" });
    return;
  }
  const user = db
    .prepare(`SELECT id, business_id, email, name, role, employee_id, avatar_color FROM users WHERE id = ?`)
    .get(userId) as User | undefined;
  if (!user) {
    res.status(401).json({ error: "Usuario no encontrado" });
    return;
  }
  req.user = user;
  next();
}

export function ownerOnly(req: AuthedRequest, res: Response, next: NextFunction) {
  if (req.user?.role !== "owner") {
    res.status(403).json({ error: "Solo el dueño puede realizar esta acción" });
    return;
  }
  next();
}

export function adminOnly(req: AuthedRequest, res: Response, next: NextFunction) {
  if (req.user?.role !== "admin") {
    res.status(403).json({ error: "Acceso restringido al administrador de la plataforma" });
    return;
  }
  next();
}

export function err(res: Response, status: number, message: string) {
  return res.status(status).json({ error: message });
}