"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.authMiddleware = authMiddleware;
exports.optionalAuthMiddleware = optionalAuthMiddleware;
const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
const rbac_service_1 = require("../services/rbac.service");
/**
 * Authentication middleware
 * Validates JWT tokens and attaches user data to request
 */
function authMiddleware(req, res, next) {
    try {
        // Get token from header
        const authHeader = req.headers.authorization;
        if (!authHeader || !authHeader.startsWith('Bearer ')) {
            // For development, allow requests without auth
            if (process.env.NODE_ENV === 'development') {
                req.user = {
                    id: 'dev-user',
                    email: 'dev@example.com',
                    role: rbac_service_1.UserRole.ADMIN,
                    permissions: [rbac_service_1.Permission.TASK_CREATE, rbac_service_1.Permission.TASK_UPDATE, rbac_service_1.Permission.TASK_DELETE],
                };
                return next();
            }
            res.status(401).json({
                success: false,
                error: 'No token provided',
            });
            return;
        }
        const token = authHeader.substring(7);
        const secret = process.env.JWT_SECRET || 'development-secret';
        // Verify token
        const decoded = jsonwebtoken_1.default.verify(token, secret);
        // Attach user to request
        req.user = {
            id: decoded.id || decoded.sub,
            email: decoded.email,
            role: decoded.role || rbac_service_1.UserRole.USER,
            permissions: decoded.permissions || [rbac_service_1.Permission.TASK_VIEW],
        };
        next();
    }
    catch (error) {
        console.error('Auth middleware error:', error);
        res.status(401).json({
            success: false,
            error: 'Invalid token',
        });
    }
}
/**
 * Optional authentication middleware
 * Validates token if present but doesn't require it
 */
function optionalAuthMiddleware(req, res, next) {
    try {
        const authHeader = req.headers.authorization;
        if (!authHeader || !authHeader.startsWith('Bearer ')) {
            return next();
        }
        const token = authHeader.substring(7);
        const secret = process.env.JWT_SECRET || 'development-secret';
        const decoded = jsonwebtoken_1.default.verify(token, secret);
        req.user = {
            id: decoded.id || decoded.sub,
            email: decoded.email,
            role: decoded.role || rbac_service_1.UserRole.USER,
            permissions: decoded.permissions || [rbac_service_1.Permission.TASK_VIEW],
        };
        next();
    }
    catch (error) {
        // Token is invalid but we continue anyway since auth is optional
        next();
    }
}
//# sourceMappingURL=auth.middleware.js.map