import { Request, Response, NextFunction } from 'express';

export type AccessRule = { role: string; product?: string };

export const STYLES_RULES: AccessRule[] = [
  { role: 'admin' },
  { role: 'user', product: 'styles' },
  { role: 'user', product: 'premium' },
];

export function requireAccess( rules: AccessRule[] )
{
  return ( req: Request, res: Response, next: NextFunction ): void =>
  {
    const auth = req.auth;
    if ( !auth )
    {
      if ( req.accepts( 'html' ) )
      {
        res.redirect( `https://account.rokojori.com/login?redirect=${encodeURIComponent( req.originalUrl )}` );
      }
      else
      {
        res.status( 401 ).json( { error: 'Not authenticated' } );
      }
      return;
    }

    if ( auth.roles.includes( 'superadmin' ) ) { next(); return; }

    const allowed = rules.some( rule =>
      auth.roles.includes( rule.role ) &&
      ( !rule.product || auth.products.includes( rule.product ) )
    );

    if ( allowed ) { next(); return; }

    if ( req.accepts( 'html' ) )
    {
      res.redirect( '/' );
    }
    else
    {
      res.status( 403 ).json( { error: 'Forbidden' } );
    }
  };
}