import { Response, NextFunction } from "express";
import jwt from "jsonwebtoken";
import AuthConfig from "../config/authConfig";
import { CustomRequest, jwtPayload } from "../interfaces/auth";
import { ROLE } from "../constants/enums";

export const checkAdmin = (
  req: CustomRequest,
  res: Response,
  next: NextFunction
) => {
  try {
    const tokenHeader = req.headers["authorization"];
    if (!tokenHeader) {
      return res.status(401).json({ message: "Unauthorized" });
    }
    const token = tokenHeader.split(" ")[1];
    if (!token) {
      return res.status(401).json({ message: "No token provided" });
    }

    const decoded = jwt.verify(
      token,
      String(AuthConfig.JWT_SECRET)
    ) as jwtPayload;

    if (decoded.role !== ROLE.ADMIN) {
      return res.status(403).json({ message: "Admin access required" });
    }

    req.userId = decoded.id;
    req.email = decoded.email;
    req.role = decoded.role;
    next();
  } catch {
    return res.status(401).json({ message: "Invalid or expired token" });
  }
};