const jwt = require('jsonwebtoken');
const { Pool } = require('pg');

const pgPool = new Pool({
    host: process.env.PGHOST || 'postgres',
    port: process.env.PGPORT || 5432,
    user: process.env.PGUSER || 'postgres',
    password: process.env.PGPASSWORD || 'postgres',
    database: process.env.PGDATABASE || 'ckqr',
});

const verifyToken = (req, res, next) => {
  let token = req.headers['authorization'];

  // Check cookies if no auth header
  if (!token && req.cookies && req.cookies.token) {
    token = req.cookies.token;
  } else if (token && token.startsWith('Bearer ')) {
    token = token.slice(7, token.length).trimLeft();
  }

  if (!token) return res.status(403).json({ error: 'Token missing from header' });

  jwt.verify(token, process.env.JWT_SECRET || 'supersecret123', (err, decoded) => {
    if (err) return res.status(401).json({ error: 'Unauthorized' });
    req.user = decoded;
    next();
  });
};

const requireEmailVerification = async (req, res, next) => {
    try {
        const userCheck = await pgPool.query('SELECT is_email_verified FROM users WHERE id = $1', [req.user.id]);
        if (userCheck.rows.length === 0 || !userCheck.rows[0].is_email_verified) {
            return res.status(403).json({ error: 'Email verification required' });
        }
        next();
    } catch (err) {
        console.error(err);
        res.status(500).json({ error: 'Server error checking verification' });
    }
};

module.exports = { verifyToken, requireEmailVerification };