const jwt = require("jsonwebtoken");
require("dotenv").config();

// module.exports = function (req, res, next) {
//   const authHeader = req.headers["authorization"];
//   const token = authHeader && authHeader.split(" ")[1]; // Expect "Bearer <token>"

//   if (!token) return res.status(403).json({ message: "Access denied, token missing" });

//   jwt.verify(token, process.env.JWT_SECRET, (err, decoded) => {
//     if (err) return res.status(401).json({ message: "Invalid or expired token" });
//     req.user = decoded;
//     next();
//   });
// };


const authJWT = (req, res, next) => {
  try {
    const token =
      req.cookies?.auth_token ||
      (req.headers.authorization && req.headers.authorization.split(" ")[1]);

    if (!token) {
      return res
        .status(403)
        .json({ status: "failed", message: "Access denied, token missing" });
    }



    jwt.verify(token, process.env.JWT_SECRET, (err, decoded) => {
      if (err) return res.status(401).json({ message: "Invalid or expired token" });
      req.user = decoded;
      next();
    });


  } catch (err) {
    return res
      .status(403)
      .json({ status: "failed", message: "Unauthorized: Invalid token" });
  }
};

module.exports = authJWT;