import { NextRequest, NextResponse } from 'next/server';
import jwt from 'jsonwebtoken';

const JWT_SECRET = process.env.JWT_SECRET || 'super_secret_jwt_key_change_in_production_min_32_chars';
const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || '7d';

export interface AuthUser {
  id: string;
  email: string;
  role: 'super_admin' | 'admin' | 'student';
  status?: string;
}

/**
 * Generate a signed JWT token
 */
export function signToken(payload: AuthUser): string {
  return jwt.sign(payload, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN as any });
}

/**
 * Verify a JWT token
 */
export function verifyToken(token: string): AuthUser | null {
  try {
    return jwt.verify(token, JWT_SECRET) as AuthUser;
  } catch {
    return null;
  }
}

/**
 * Extract authenticated user from Authorization header
 */
export function getAuthUser(req: NextRequest): AuthUser | null {
  const authHeader = req.headers.get('authorization');
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return null;
  }
  const token = authHeader.split(' ')[1];
  return verifyToken(token);
}

/**
 * Authentication Guard: Ensure user is logged in
 */
export function requireAuth(req: NextRequest): { user: AuthUser } | NextResponse {
  const user = getAuthUser(req);
  if (!user) {
    return NextResponse.json({ success: false, error: 'Unauthorized: Authentication token missing or invalid' }, { status: 401 });
  }
  return { user };
}

/**
 * Admin Guard: Ensure user is an admin or super_admin
 */
export function requireAdmin(req: NextRequest): { user: AuthUser } | NextResponse {
  const auth = requireAuth(req);
  if (auth instanceof NextResponse) return auth;
  if (auth.user.role !== 'admin' && auth.user.role !== 'super_admin') {
    return NextResponse.json({ success: false, error: 'Forbidden: Admin access required' }, { status: 403 });
  }
  return auth;
}

/**
 * Super Admin Guard: Ensure user is super_admin
 */
export function requireSuperAdmin(req: NextRequest): { user: AuthUser } | NextResponse {
  const auth = requireAuth(req);
  if (auth instanceof NextResponse) return auth;
  if (auth.user.role !== 'super_admin') {
    return NextResponse.json({ success: false, error: 'Forbidden: Super Admin access required' }, { status: 403 });
  }
  return auth;
}

/**
 * Student Guard: Ensure user is a student
 */
export function requireStudent(req: NextRequest): { user: AuthUser } | NextResponse {
  const auth = requireAuth(req);
  if (auth instanceof NextResponse) return auth;
  if (auth.user.role !== 'student') {
    return NextResponse.json({ success: false, error: 'Forbidden: Student access required' }, { status: 403 });
  }
  return auth;
}