const jwt = require('jsonwebtoken')
const User = require('./models/User')

const authentication = {
  // secret for generating jwt token
  secretKey: 'e0e8d636461367747ae3db04ca27a50ce141795c782e3999b8663cd92acf6fafad3d6c9655e1604ab2d6cc3c1b1272d588738ea3c2180542974eb02e017b4322',
  // check if just logged in (admin-or-user) (middleware)
  isLoggedIn: function (req, res, next) {
    const token = req?.headers?.authorization?.replace(/^Bearer\s/, '')
    if (token) {
      // check if token is not destroyed
      User.findOne({token: token}, (err, user) => {
        if (err) throw err
        if (user) {
          // verifies secret and checks if the token is expired
          jwt.verify(user.token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
            if (err) return res.status(401).json({message: 'unauthorized'})
            else {
              req.user = {
                _id : user._id,
                scope : user.scope,
                private : user.private,
                first_name : user.first_name,
                last_name : user.last_name,
                username : user.username,
                permissions : user.permissions,
                business_code : user.business_code,
                mobile_number : user.mobile_number,
                currentBranch: user?.currentBranch,
                branches: user?.branches,
              }
              return next()
            }
          })
        } else return res.status(401).json({message: 'unauthorized'})
      })
    } else {
      return res.status(401).json({message: 'unauthorized'})
    }
  },
  // check if admin logged in (middleware)
  isAdmin: function (req, res, next) {
    const token = req?.headers?.authorization?.replace(/^Bearer\s/, '')
    if (token) {
      // check if token is not destroyed
      User.findOne({token: token}, (err, user) => {
        if (err) throw err
        if (user) {
          // verifies secret and checks if the token is expired
          jwt.verify(user.token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
            if (err || !user.scope.includes('admin')) return res.status(401).json({message: 'unauthorized'})
            else {
              req.user = {
                _id : user._id,
                scope : user.scope,
                private : user.private,
                first_name : user.first_name,
                last_name : user.last_name,
                username : user.username,
                permissions : user.permissions,
                business_code : user.business_code,
                mobile_number : user.mobile_number,
                fcmToken : user.fcmToken,
                currentBranch: user?.currentBranch,
                branches: user?.branches,
              }
              return next()
            }
          })
        } else return res.status(401).json({message: 'unauthorized'})
      })
    } else {
      return res.status(401).json({message: 'unauthorized'})
    }
  },
  // check if admin logged in (middleware)
  isUser: function (req, res, next) {
    const token = req?.headers?.authorization?.replace(/^Bearer\s/, '')
    if (token) {
      // check if token is not destroyed
      User.findOne({token: token}, (err, user) => {
        if (err) throw err
        if (user) {
          // verifies secret and checks if the token is expired
          jwt.verify(user.token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
            if (err || !user.scope.includes('user')) return res.status(401).json({message: 'unauthorized'})
            else {
              req.user = {
                _id : user._id,
                scope : user.scope,
                private : user.private,
                first_name : user.first_name,
                last_name : user.last_name,
                username : user.username,
                permissions : user.permissions,
                business_code : user.business_code,
                mobile_number : user.mobile_number,
                fcmToken : user.fcmToken,
                currentBranch: user?.currentBranch,
                branches: user?.branches,
              }
              return next()
            }
          })
        } else return res.status(401).json({message: 'unauthorized'})
      })
    } else {
      return res.status(401).json({message: 'unauthorized'})
    }
  },
  // get user id from token
  getID: (req) => {
    const token = req.headers.authorization
    return jwt.verify(token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
      if (err) return 'unauthorized'
      else return decoded._id
    })
  },
  // check if user has permission (middleware)
  hasPermission: (permission) => {
    return (req, res, next) => {
      const token = req.headers.authorization
      if (token) {
        // check if token is not destroyed
        User.findOne({token: token}, (err, user) => {
          if (err || !user) return res.status(401).json({message: 'unauthorized'})
          if (user.permissions.includes('super-admin')) return next()
          if (!user.permissions.includes(permission)) return res.status(401).json({message: 'unauthorized'})
          else return next()
        })
      } else {
        return res.status(401).json({message: 'unauthorized'})
      }
    }
  }
}

module.exports = authentication