package middleware

import (
	"strings"

	"github.com/gofiber/fiber/v3"

	"github.com/peterqiu0516/sub-store/internal/util"
)

// ExtractToken extracts the admin/download token from the request.
// Per review-resolution #26: three sources, priority: Bearer header → query ?token → x-sub-store-token header.
func ExtractToken(c fiber.Ctx) string {
	// 1. Authorization: Bearer <token>
	auth := c.Get("Authorization")
	if strings.HasPrefix(strings.ToLower(auth), "bearer ") {
		return strings.TrimSpace(auth[7:])
	}
	// 2. ?token=<token>
	if token := c.Query("token"); token != "" {
		return token
	}
	// 3. x-sub-store-token header
	return c.Get("X-Sub-Store-Token")
}

// RequireAdmin returns a middleware that checks the admin token.
func RequireAdmin(adminToken string) fiber.Handler {
	return func(c fiber.Ctx) error {
		if !util.IsTokenValid(ExtractToken(c), adminToken) {
			return c.Status(401).JSON(fiber.Map{
				"status": "failed",
				"error":  fiber.Map{"code": 401, "message": "Admin token is invalid"},
			})
		}
		return c.Next()
	}
}