var jwt = require('jsonwebtoken')

var JWT_SECRET = process.env.JWT_SECRET || 'hox_jwt_secret_change_in_production'
var JWT_EXPIRES_IN = '7d'

function generateToken(userId, openid) {
  return jwt.sign(
    { user_id: userId, openid: openid },
    JWT_SECRET,
    { expiresIn: JWT_EXPIRES_IN }
  )
}

function verifyToken(token) {
  try {
    return jwt.verify(token, JWT_SECRET)
  } catch (e) {
    return null
  }
}

function generateAdminToken(adminId, username, role) {
  return jwt.sign(
    { admin_id: adminId, username: username, role: role, type: 'admin' },
    JWT_SECRET,
    { expiresIn: JWT_EXPIRES_IN }
  )
}

function extractToken(event) {
  var header = event.headers || {}
  var auth = header['Authorization'] || header['authorization'] || header['authorization'] || ''
  if (auth.startsWith('Bearer ')) {
    return auth.substring(7)
  }
  return null
}

function extractUser(event) {
  var token = extractToken(event)
  if (!token) return null
  var decoded = verifyToken(token)
  if (!decoded || decoded.type === 'admin') return null
  return decoded
}

function extractAdmin(event) {
  var token = extractToken(event)
  if (!token) return null
  var decoded = verifyToken(token)
  if (!decoded || decoded.type !== 'admin') return null
  return decoded
}

module.exports = {
  generateToken: generateToken,
  verifyToken: verifyToken,
  generateAdminToken: generateAdminToken,
  extractToken: extractToken,
  extractUser: extractUser,
  extractAdmin: extractAdmin
}