import jwt from 'jsonwebtoken'
import { H3Event, createError } from 'h3'

export interface AuthUser {
  id: string
  email: string
  username: string
  displayName?: string
  role?: string
}

export function generateToken(user: AuthUser): string {
  const config = useRuntimeConfig()
  const secret = config.jwtSecret || 'your-super-secret-jwt-key'
  
  return jwt.sign(
    { 
      id: user.id, 
      email: user.email, 
      username: user.username, 
      displayName: user.displayName,
      role: user.role || 'user' 
    },
    secret,
    { expiresIn: '7d' }
  )
}

export function verifyToken(token: string): AuthUser {
  const config = useRuntimeConfig()
  const secret = config.jwtSecret || 'your-super-secret-jwt-key'
  
  return jwt.verify(token, secret) as AuthUser
}

export function getAuthUser(event: H3Event): AuthUser | null {
  const authHeader = getHeader(event, 'authorization')
  const token = authHeader?.split(' ')[1]
  if (!token) return null
  try {
    return verifyToken(token)
  } catch {
    return null
  }
}

export function requireAuth(event: H3Event): AuthUser {
  const user = getAuthUser(event)
  if (!user) {
    throw createError({ statusCode: 401, message: 'Unauthorized' })
  }
  return user
}

export function requireRole(event: H3Event, role: string): AuthUser {
  const user = requireAuth(event)
  if (user.role !== role) {
    throw createError({ statusCode: 403, message: 'Forbidden' })
  }
  return user
}