const db = require('./db')
const { fail } = require('./http')

function headerToken(req) {
  return String(req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim()
}

function isAdmin(openid, data) {
  return (data || db.read()).adminAllowlist.includes(openid)
}

function userAuth(req, res, next) {
  const token = headerToken(req)
  const user = token && db.read().users.find((item) => item.token === token)
  if (!user) return fail(res, 401, '请先登录')
  req.user = user
  next()
}

function requireUserAdmin(req, res, next) {
  if (!req.user || !isAdmin(req.user.openid)) return fail(res, 403, '仅管理员可操作')
  next()
}

// Query tokens are only accepted where a plain link must work (CSV download).
function adminAuth(options) {
  const allowQuery = !!(options && options.allowQueryToken)
  return (req, res, next) => {
    const token = headerToken(req) || (allowQuery ? String(req.query.token || '').trim() : '')
    const admin = token && db.read().admins.find((item) => item.token === token)
    if (!admin) return fail(res, 401, '请先登录管理后台')
    req.admin = admin
    next()
  }
}

module.exports = { userAuth, requireUserAdmin, adminAuth, isAdmin }