package middleware

import (
	"fmt"
	"strings"

	"github.com/gin-gonic/gin"
	"github.com/golang-jwt/jwt/v5"
	"github.com/muyuqingfeng/iloom/shared/pkg/auth"
	"github.com/muyuqingfeng/iloom/shared/pkg/response"
)

func AuthRequired(jwtSecret string) gin.HandlerFunc {
	secret := []byte(jwtSecret)

	return func(c *gin.Context) {
		header := c.GetHeader("Authorization")
		if header == "" {
			response.Unauthorized(c, "missing authorization header")
			c.Abort()
			return
		}

		parts := strings.SplitN(header, " ", 2)
		if len(parts) != 2 || !strings.EqualFold(parts[0], "bearer") {
			response.Unauthorized(c, "invalid authorization format")
			c.Abort()
			return
		}

		tokenStr := parts[1]
		token, err := jwt.ParseWithClaims(tokenStr, &auth.Claims{}, func(t *jwt.Token) (interface{}, error) {
			if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
				return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
			}
			return secret, nil
		})
		if err != nil {
			response.Error(c, 401, response.ErrCodeTokenExpired, "token expired or invalid")
			c.Abort()
			return
		}

		claims, ok := token.Claims.(*auth.Claims)
		if !ok || !token.Valid {
			response.Error(c, 401, response.ErrCodeTokenInvalid, "invalid token")
			c.Abort()
			return
		}

		c.Set("user_id", claims.UserID)
		c.Set("company_id", claims.CompanyID)
		c.Set("role", claims.Role)
		c.Set("is_master", claims.IsMaster)
		c.Set("username", claims.Username)

		c.Request.Header.Set("X-User-ID", claims.UserID)
		c.Request.Header.Set("X-Company-ID", claims.CompanyID)
		c.Request.Header.Set("X-User-Role", claims.Role)
		c.Request.Header.Set("X-Is-Master", fmt.Sprintf("%t", claims.IsMaster))
		c.Request.Header.Set("X-Username", claims.Username)

		c.Next()
	}
}