package middleware

import (
	"net/http"
	"strings"

	"github.com/labstack/echo/v4"

	"osdb/internal/auth"
)

// JWTAuth returns an Echo middleware that requires a valid Bearer JWT.
func JWTAuth(secret string) echo.MiddlewareFunc {
	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			header := c.Request().Header.Get("Authorization")
			if !strings.HasPrefix(header, "Bearer ") {
				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "missing token"})
			}
			tokenStr := strings.TrimPrefix(header, "Bearer ")
			if _, err := auth.ValidateJWT(tokenStr, secret); err != nil {
				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid token"})
			}
			return next(c)
		}
	}
}