const bcrypt = require("bcryptjs");
const jwt = require("jsonwebtoken");
const db = require("../models");
const sanitize = require("sanitize-html");
const EstablishmentUser = db.EstablishmentUser;
const logger = require("../services/logger");

const sanitizeStringValue = (value) =>
  typeof value === "string"
    ? sanitize(value, { allowedTags: [], allowedAttributes: {} })
    : value;

// User Login
exports.login = async (req, res) => {
  try {
    const email = sanitizeStringValue(req.body.email);
    const password = req.body.password;
    if (!email || !password)
      return res.status(400).send({'status':"failed",'message':"Email and password required",'data': ""}); 

    const user = await EstablishmentUser.findOne({ where: { email } });
    if (!user) res.status(404).send({'status':"failed",'message':"User not found",'data': ""}); 

    const validPassword = await bcrypt.compare(password, user.password);
    if (!validPassword)
      return res.status(401).json({ message: "Invalid password" });
    // Create JWT token
   const token = jwt.sign(
      {
        id: user.id,
        email: sanitizeStringValue(user.email),
        name: sanitizeStringValue(user.name),
        establishment_id: user.establishment_id
      },
      process.env.JWT_SECRET,
      { expiresIn: "6h" }
    );

    res.status(200).send({'status':"success",'message':"Login successful",'data': token }); 

  } catch (err) {
    logger.error(err.message);
    logger.error(`Stack trace: ${err.stack}`);
    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
};

// User Logout (JWT-based — just a client-side operation)
exports.logout = async (req, res) => {
  try {
    // For JWT, logout is handled on the client (by deleting token)
    // But you can still log or blacklist token if needed
    res.status(200).send({'status':"success",'message':"Logout successful",'data': "" }); 
    res.status(200).json({ message: "Logout successful (client should discard token)" });
  } catch (err) {
    logger.error(err.message);
    logger.error(`Stack trace: ${err.stack}`);
    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
};