const jwt = require('jsonwebtoken');
require('dotenv').config();

const JWT_SECRET = process.env.JWT_SECRET;

const ERROR_LOG_API_URL =
  process.env.ERROR_LOG_API_URL ||
  "https://error.xtransit.testinstance.nl/error_log";

function log(level, message, meta = {}) {
  const timestamp = new Date().toISOString();
  console.log(JSON.stringify({ timestamp, level, service: "transit_api", message, ...meta }));
}

async function reportError({ partofservice, error }) {
  try {
    await fetch(ERROR_LOG_API_URL, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-internal-api-key": process.env.INTERNAL_API_KEY || "",
      },
      body: JSON.stringify({
        service: "transit_api",
        partofservice,
        error,
      }),
    });
  } catch (_) {}
}

// Middleware to verify JWT token
const authMiddleware = (req, res, next) => {
  const auth = req.headers.authorization;
  if (!auth || !auth.startsWith('Bearer ')) {
    log("warn", "Missing or invalid Authorization header", { path: req.originalUrl });
    return res.status(401).json({ error: 'missing_token' });
  }

  const token = auth.slice(7);
  try {
    const payload = jwt.verify(token, JWT_SECRET);
    req.user = payload;
    next();
  } catch (err) {
    log("error", "JWT verification failed", { error: err.message, path: req.originalUrl });
    void reportError({
      partofservice: `authMiddleware ${req.method} ${req.originalUrl}`,
      error: err.stack || err.message,
    });
    return res.status(401).json({ error: 'invalid_token' });
  }
};


// Middleware to enforce admin role
const adminMiddleware = (req, res, next) => {
  if (!req.user || !req.user.isAdmin) {
    return res.status(403).json({ error: "forbidden" });
  }

  next();
};

module.exports = { authMiddleware, adminMiddleware };