import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import { Role } from "@prisma/client";
import { prisma } from "@/server/db";
import { verifyAccessToken } from "@/server/security/jwt";
import { hasRole } from "@/server/security/rbac";

export async function requirePageUser() {
  const cookieStore = await cookies();
  const token = cookieStore.get("access_token")?.value;

  if (!token) {
    redirect("/register");
  }

  const auth = await getPageAuth(token);

  if (!auth) {
    redirect("/register");
  }

  return auth;
}

export async function requirePageRole(allowed: Role[]) {
  const auth = await requirePageUser();

  if (!hasRole(auth.roles, allowed)) {
    redirect("/");
  }

  return auth;
}

async function getPageAuth(token: string) {
  try {
    const claims = await verifyAccessToken(token);
    const session = await prisma.session.findFirst({
      where: {
        id: claims.sessionId,
        userId: claims.sub,
        revokedAt: null,
        expiresAt: { gt: new Date() }
      }
    });

    if (!session) {
      return null;
    }

    const user = await prisma.user.findUnique({
      where: { id: claims.sub },
      include: { profile: true }
    });

    if (!user) {
      return null;
    }

    return { user, session, roles: claims.roles };
  } catch {
    return null;
  }
}