import jwt from "jsonwebtoken";
import { config } from "../config.js";
import { prisma } from "../db.js";

export async function requireAuth(request, response, next) {
  try {
    const [scheme, token] = String(request.headers.authorization || "").split(" ");
    if (scheme !== "Bearer" || !token) {
      return response.status(401).json({ error: "Authentication required" });
    }
    const payload = jwt.verify(token, config.JWT_SECRET);
    const user = await prisma.user.findUnique({ where: { id: payload.sub } });
    if (!user) return response.status(401).json({ error: "Account no longer exists" });
    request.user = user;
    next();
  } catch {
    response.status(401).json({ error: "Invalid or expired session" });
  }
}