import jwt
from fastapi import HTTPException, Security, Depends
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
from supabase_client import supabase
from config import SUPABASE_JWT_SECRET
from typing import Optional

security = HTTPBearer()

async def get_current_user(credentials: HTTPAuthorizationCredentials = Security(security)):
    token = credentials.credentials
    try:
        payload = jwt.decode(token, SUPABASE_JWT_SECRET, algorithms=["HS256"], audience="authenticated")
        user_id = payload.get("sub")
        if not user_id:
            raise HTTPException(status_code=401, detail="Invalid token")
        # Optionally fetch user profile
        profile = supabase.table("profiles").select("*").eq("id", user_id).execute()
        if not profile.data:
            raise HTTPException(status_code=404, detail="User profile not found")
        return {"id": user_id, "email": payload.get("email"), "profile": profile.data[0]}
    except Exception as e:
        raise HTTPException(status_code=401, detail=f"Invalid authentication: {e}")