import { cookies } from 'next/headers';
import { verify } from 'jsonwebtoken';
import prisma from './prisma';

export async function getCurrentUser() {
  try {
    const cookieStore = cookies();
    const token = cookieStore.get('auth-token')?.value;
    
    if (!token) return null;
    
    const decoded = verify(token, process.env.JWT_SECRET || 'uwezo-hrms-super-secret-key-2026');
    const user = await prisma.user.findUnique({
      where: { id: (decoded as any).userId },
      include: { employee: true }
    });
    
    return user;
  } catch (error) {
    return null;
  }
}

export async function requireAuth(allowedRoles?: string[]) {
  const user = await getCurrentUser();
  if (!user) return { error: 'Unauthorized', status: 401 };
  if (allowedRoles && !allowedRoles.includes(user.role)) {
    return { error: 'Forbidden', status: 403 };
  }
  return { user };
}