const bcrypt = require('bcrypt');

// Hash (signup)
const hash = await bcrypt.hash(plainPassword, 10); // 10 = cost factor

// Verify (login)
const ok = await bcrypt.compare(plainPassword, storedHash);

// NEVER: storing plaintext, or comparing with === against a stored hash

const jwt = require('jsonwebtoken');

// Sign
const token = jwt.sign(
  { userId: user.id, role: user.role },
  process.env.JWT_SECRET,
  { expiresIn: '15m' }
);

// Verify
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET);
} catch (err) {
  // err.name === 'TokenExpiredError' | 'JsonWebTokenError'
}

// Decode WITHOUT verifying (readable by anyone -- not a security check)
jwt.decode(token);

function requireAuth(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'no token' });
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch {
    res.status(401).json({ error: 'invalid or expired token' });
  }
}

function requireRole(role) {
  return (req, res, next) =>
    req.user.role === role
      ? next()
      : res.status(403).json({ error: 'forbidden' });
}

app.get('/admin', requireAuth, requireRole('admin'), handler);

const session = require('express-session');

app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: 'strict', maxAge: 3600000 }
}));

// Regenerate on login (prevents session fixation)
req.session.regenerate((err) => { req.session.userId = user.id; });

// Destroy on logout
req.session.destroy();