"use strict";
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.adminAuth = exports.auth = void 0;
const client_1 = require("@prisma/client");
const prisma_1 = __importDefault(require("../utils/prisma"));
const auth = (req, reply, publicAcess) => __awaiter(void 0, void 0, void 0, function* () {
    const bearerToken = req.headers.authorization;
    if (!bearerToken) {
        return reply.status(401).send({ message: "Authentication required" });
    }
    const token = bearerToken.split(" ")[1];
    const decoded = req.jwt.verify(token);
    const user = yield prisma_1.default.user.findUnique({
        where: {
            id: decoded.id,
            active: true,
        },
        select: { id: true, role: true, active: true, member: true },
    });
    if (!user || !user.active) {
        return reply.status(401).send({
            message: "Aucun compte actif trouvé avec ces informations",
        });
    }
    if (user.role === client_1.$Enums.Role.User && !publicAcess && !user.member) {
        return reply.status(400).send({
            message: "Vous n'êtes pas un adhérant",
        });
    }
    req.user = decoded;
});
exports.auth = auth;
const adminAuth = (req, reply, permission) => __awaiter(void 0, void 0, void 0, function* () {
    const bearerToken = req.headers.authorization;
    if (!bearerToken) {
        return reply.status(401).send({ message: "Authentication required" });
    }
    const token = bearerToken.split(" ")[1];
    const decoded = req.jwt.verify(token);
    if (decoded.role === client_1.$Enums.Role.User) {
        return reply.status(401).send({
            message: "Vous n'êtes pas admin ou fonctionnaire",
        });
    }
    // TODO: Find a better way istead of abusing the db
    const user = yield prisma_1.default.user.findUnique({
        where: {
            id: decoded.id,
            role: { in: [client_1.$Enums.Role.Admin, client_1.$Enums.Role.SubAdmin] },
            active: true,
        },
        select: { id: true, role: true, permissions: true, active: true },
    });
    if (!user || !user.active) {
        return reply.status(401).send({
            message: "Aucun compte actif trouvé avec ces informations",
        });
    }
    if (permission !== undefined && // means everyone have access
        user.role === client_1.$Enums.Role.SubAdmin &&
        req.method !== "GET" &&
        permission !== "Settings" &&
        (permission === null ||
            (permission !== null && !user.permissions.includes(permission)))) {
        return reply.status(400).send({
            message: "Vous n'avez pas les permissions nécessaires pour effectuer cette action",
        });
    }
    req.user = decoded;
});
exports.adminAuth = adminAuth;
