import { config } from '../config.js'

export async function requireAppwriteStaff(req, res, next) {
  const authHeader = req.get('Authorization') || ''
  const match = authHeader.match(/^Bearer\s+(.+)$/i)
  if (!match) {
    return res.status(401).json({ error: 'Authorization Bearer JWT erforderlich' })
  }

  const jwt = match[1]

  try {
    const response = await fetch(`${config.appwrite.endpoint}/account`, {
      headers: {
        'Content-Type': 'application/json',
        'X-Appwrite-Project': config.appwrite.projectId,
        'X-Appwrite-JWT': jwt,
      },
    })

    const text = await response.text()
    let data = null
    if (text) {
      try {
        data = JSON.parse(text)
      } catch {
        data = { message: text }
      }
    }

    if (!response.ok) {
      return res.status(401).json({ error: data?.message || 'Ung�ltiges JWT' })
    }

    if (!Array.isArray(data?.labels) || !data.labels.includes('admin')) {
      return res.status(403).json({ error: 'Admin-Berechtigung erforderlich' })
    }

    req.appwriteUser = data
    return next()
  } catch (err) {
    return res.status(500).json({ error: err.message || 'JWT-Validierung fehlgeschlagen' })
  }
}