const bcrypt = require("bcryptjs");
const jwt = require("jsonwebtoken");
const db = require("../models");
const EstablishmentUser = db.EstablishmentUser;

// User Login
exports.login = async (req, res) => {
  try {
    const { email, password } = req.body;
    if (!email || !password)
      return res.status(400).send({'status':"failed",'message':"Email and password required",'data': ""}); 

    const user = await EstablishmentUser.findOne({ where: { email } });
    if (!user) res.status(404).send({'status':"failed",'message':"User not found",'data': ""}); 

    const validPassword = await bcrypt.compare(password, user.password);
    if (!validPassword)
      return res.status(401).json({ message: "Invalid password" });

    // Create JWT token
    const token = jwt.sign({ id: user.id, email: user.email , name: user.name, establishment_id: user.establishment_id }, process.env.JWT_SECRET, {
      expiresIn: "6h",
    });

    res.status(200).send({'status':"success",'message':"Login successful",'data': token }); 

  } catch (err) {
    res.status(500).send({'status':"failed",'message':err.message });
  }
};

// User Logout (JWT-based — just a client-side operation)
exports.logout = async (req, res) => {
  try {
    // For JWT, logout is handled on the client (by deleting token)
    // But you can still log or blacklist token if needed
    res.status(200).send({'status':"success",'message':"Logout successful",'data': "" }); 
    res.status(200).json({ message: "Logout successful (client should discard token)" });
  } catch (err) {
    res.status(500).send({'status':"failed",'message':err.message });
  }
};