use axum::{
    extract::Request,
    http::{StatusCode, header},
    middleware::Next,
    response::Response,
};
use sb_auth::jwt::verify_token;

#[derive(Clone)]
pub struct AuthUser {
    pub user_id: u32,
    pub name: String,
    pub role: String,
}

pub async fn auth_middleware(mut request: Request, next: Next) -> Result<Response, StatusCode> {
    let auth_header = request
        .headers()
        .get(header::AUTHORIZATION)
        .and_then(|v| v.to_str().ok())
        .unwrap_or("");

    let token = auth_header.strip_prefix("Bearer ").unwrap_or(auth_header);

    if token.is_empty() {
        return Err(StatusCode::UNAUTHORIZED);
    }

    let claims = verify_token(token).map_err(|_| StatusCode::UNAUTHORIZED)?;

    request.extensions_mut().insert(AuthUser {
        user_id: claims.sub,
        name: claims.name,
        role: claims.role,
    });

    Ok(next.run(request).await)
}

impl std::fmt::Debug for AuthUser {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("AuthUser")
            .field("user_id", &self.user_id)
            .field("name", &self.name)
            .field("role", &self.role)
            .finish()
    }
}