import { admin } from './firebase.js';

// ── Strict Authentication Middleware ──
export async function requireStrictAuth(req, res, next) {
    const authHeader = req.headers.authorization;

    if (!authHeader || !authHeader.startsWith('Bearer ')) {
        return res.status(401).json({
            error: 'UNAUTHORIZED',
            message: 'Missing Authorization Bearer token header.'
        });
    }

    const token = authHeader.substring(7).trim();

    try {
        const decodedToken = await admin.auth().verifyIdToken(token);
        const uid = decodedToken.uid;
        const signInProvider = decodedToken.firebase?.sign_in_provider || '';
        const isAnonymous = signInProvider === 'anonymous';

        if (isAnonymous) {
            return res.status(403).json({
                error: 'ANONYMOUS_NOT_ALLOWED',
                message: 'Guest/anonymous accounts cannot generate or download resumes. Please sign in or create an account to proceed.'
            });
        }

        req.user = {
            uid,
            email: decodedToken.email
        };

        next();
    } catch (error) {
        console.error('[Auth Error]', error.message);
        return res.status(401).json({
            error: 'UNAUTHORIZED',
            message: 'Invalid or expired Firebase authentication token.'
        });
    }
}