import { Request, Response, NextFunction } from "express";
import jwt from "jsonwebtoken";
import { env } from "../../config/env";
import { UnauthorizedError } from "../errors/http-errors";
import type { AuthUser } from "../types/express";

export function authMiddleware(
  req: Request,
  _res: Response,
  next: NextFunction,
) {
  const header = req.headers.authorization;
  let token: string | undefined;

  if (header && header.startsWith("Bearer ")) {
    token = header.slice("Bearer ".length);
  } else if (req.cookies?.accessToken) {
    token = req.cookies.accessToken;
  } else if (req.cookies?.token) {
    token = req.cookies.token;
  }

  if (!token) {
    throw new UnauthorizedError("Missing authentication token");
  }

  try {
    const payload = jwt.verify(token, env.JWT_ACCESS_SECRET) as AuthUser;
    req.user = payload;
    req.tenantId = payload.organizationId ?? payload.tenantId ?? undefined;
    next();
  } catch {
    throw new UnauthorizedError("Invalid or expired token");
  }
}