import { Elysia } from "elysia";
import { jwt } from "@elysiajs/jwt";

export const JWT_SECRET = process.env.JWT_SECRET || "homaroma_secret_2026_scent";

export async function requireAdmin({ jwt, headers, set }: any) {
  const auth = headers.authorization;
  if (!auth?.startsWith("Bearer ")) {
    set.status = 401;
    return { error: "Unauthorized: Missing or invalid token format" };
  }

  const token = auth.substring(7);
  const payload = await jwt.verify(token);

  if (!payload) {
    set.status = 401;
    return { error: "Unauthorized: Invalid token" };
  }

  if ((payload as any).role !== "ADMIN") {
    set.status = 401;
    return { error: "Unauthorized: Admin access required" };
  }
}

export const adminOnly = new Elysia({ name: "adminOnly" })
  .use(
    jwt({
      name: "jwt",
      secret: JWT_SECRET,
    })
  )
  .onBeforeHandle({ as: "scoped" }, requireAdmin);