const jwt = require('jsonwebtoken')
const User = require('./models/User')

const authentication = {
  // secret for generating jwt token
  secretKey: '6fe26a8a97c5815f00c14acca4137ec6c466dd75985168b3627ebf08b2dfd7f42ee69a322af6e3fd6dfe48ce747f3ca65a8765db425e602e08178a104e725ff9',
  // check if just logged in (admin-or-user) (middleware)
  isLoggedIn: function (req, res, next) {
    const token = req.headers.authorization
    if (token) {
      // check if token is not destroyed
      User.findOne({token: token}, (err, user) => {
        if (err) throw err
        if (user) {
          // verifies secret and checks if the token is expired
          jwt.verify(user.token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
            if (err) return res.status(401).json({message: 'unauthorized'})
            else return next()
          })
        } else return res.status(401).json({message: 'unauthorized'})
      })
    } else {
      return res.status(401).json({message: 'unauthorized'})
    }
  },
  // check if admin logged in (middleware)
  isAdmin: function (req, res, next) {
    const token = req?.headers?.authorization?.replace(/^Bearer\s/, '')
    if (token) {
      // check if token is not destroyed
      User.findOne({token: token}, (err, user) => {
        if (err) throw err
        if (user) {
          // verifies secret and checks if the token is expired
          jwt.verify(user.token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
            if (err || !user.scope.includes('admin')) return res.status(401).json({message: 'unauthorized'})
            else return next()
          })
        } else return res.status(401).json({message: 'unauthorized'})
      })
    } else {
      return res.status(401).json({message: 'unauthorized'})
    }
  },
  // check if admin logged in (middleware)
  isUser: function (req, res, next) {
    const token = req.headers.authorization
    if (token) {
      // check if token is not destroyed
      User.findOne({token: token}, (err, user) => {
        if (err) throw err
        if (user) {
          // verifies secret and checks if the token is expired
          jwt.verify(user.token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
            if (err || !user.scope.includes('user')) return res.status(401).json({message: 'unauthorized'})
            else return next()
          })
        } else return res.status(401).json({message: 'unauthorized'})
      })
    } else {
      return res.status(401).json({message: 'unauthorized'})
    }
  },
  // get user id from token
  getID: (req) => {
    const token = req.headers.authorization
    return jwt.verify(token.replace(/^Bearer\s/, ''), authentication.secretKey, (err, decoded) => {
      if (err) return 'unauthorized'
      else return decoded._id
    })
  },
  // check if user has permission (middleware)
  hasPermission: (permission) => {
    return (req, res, next) => {
      const token = req.headers.authorization
      if (token) {
        // check if token is not destroyed
        User.findOne({token: token}, (err, user) => {
          if (err || !user) return res.status(401).json({message: 'unauthorized'})
          if (user.permissions.includes('super-admin')) return next()
          if (!user.permissions.includes(permission)) return res.status(401).json({message: 'unauthorized'})
          else return next()
        })
      } else {
        return res.status(401).json({message: 'unauthorized'})
      }
    }
  }
}

module.exports = authentication