import type { AuthUser } from "@orderops/shared";
import type { FastifyReply, FastifyRequest } from "fastify";
import type { DatabaseContext } from "../db/database";
import { findSessionUser } from "./auth-repository";
import { readSessionCookie } from "./session-cookie";

export async function getCurrentUser(context: DatabaseContext, cookieHeader?: string) {
  const sessionId = readSessionCookie(cookieHeader);

  if (!sessionId) {
    return null;
  }

  return findSessionUser(context, sessionId);
}

export async function requireEmployeeUser(context: DatabaseContext, request: FastifyRequest, reply: FastifyReply): Promise<AuthUser | null> {
  const user = await getCurrentUser(context, request.headers.cookie);

  if (!user) {
    await reply.code(401).send({ message: "Authentication required." });
    return null;
  }

  if (user.role !== "employee") {
    await reply.code(403).send({ message: "Employee access required." });
    return null;
  }

  return user;
}