const jwt = require('jsonwebtoken');
const db = require('./db');
require('dotenv').config();

const SECRET = process.env.JWT_SECRET;

function sign(account) {
    return jwt.sign(
        { aid: account.id, cid: account.char_id },
        SECRET,
        { expiresIn: '7d' }
    );
}

// Middleware: prueft JWT, laedt Account frisch aus DB -> req.account
async function requireAuth(req, res, next) {
    try {
        const header = req.headers.authorization || '';
        const token = header.startsWith('Bearer ') ? header.slice(7) : null;
        if (!token) return res.status(401).json({ error: 'no_token' });

        const payload = jwt.verify(token, SECRET);
        const account = await db.q1(
            'SELECT * FROM bleeter_accounts WHERE id = ? AND char_id = ?',
            [payload.aid, payload.cid]
        );
        if (!account) return res.status(401).json({ error: 'account_gone' });
        if (account.status && account.status !== 'active') {
            return res.status(403).json({ error: 'account_disabled' });
        }
        req.account = account;
        next();
    } catch (err) {
        return res.status(401).json({ error: 'invalid_token' });
    }
}

module.exports = { sign, requireAuth };