const jwt = require('jsonwebtoken');
const User = require('../models/User');
const { log } = require('../utils/activityLogger');

const signTokens = (id) => {
  const access = jwt.sign({ id }, process.env.JWT_SECRET, { expiresIn: process.env.JWT_EXPIRES_IN || '15m' });
  const refresh = jwt.sign({ id }, process.env.JWT_REFRESH_SECRET, { expiresIn: process.env.JWT_REFRESH_EXPIRES_IN || '7d' });
  return { access, refresh };
};

// POST /api/auth/login
exports.login = async (req, res) => {
  const { username, password } = req.body;
  if (!username || !password) return res.status(400).json({ message: 'Username and password required' });

  const user = await User.findOne({ username: username.toLowerCase().trim() });
  if (!user || !user.active) return res.status(401).json({ message: 'Invalid credentials' });

  const match = await user.matchPassword(password);
  if (!match) return res.status(401).json({ message: 'Invalid credentials' });

  const { access, refresh } = signTokens(user._id);
  log(user, 'LOGIN', { ip: req.ip });

  res.json({ token: access, refreshToken: refresh, user });
};

// POST /api/auth/refresh
exports.refresh = async (req, res) => {
  const { refreshToken } = req.body;
  if (!refreshToken) return res.status(400).json({ message: 'Refresh token required' });

  try {
    const decoded = jwt.verify(refreshToken, process.env.JWT_REFRESH_SECRET);
    const user = await User.findById(decoded.id);
    if (!user || !user.active) return res.status(401).json({ message: 'User not found' });
    const { access, refresh } = signTokens(user._id);
    res.json({ token: access, refreshToken: refresh });
  } catch {
    res.status(401).json({ message: 'Invalid refresh token' });
  }
};

// GET /api/auth/me
exports.me = async (req, res) => {
  res.json(req.user);
};