<?php

namespace App\Middlewares;

use App\Core\Request;
use App\Core\Response;
use App\Core\Security;

class AuthMiddleware
{
    /**
     * Verifies the JWT token and populates request properties.
     */
    public function handle(Request $request, Response $response): void
    {
        $authHeader = $request->getHeader('authorization', '');

        if (!$authHeader || !preg_match('/Bearer\s(\S+)/i', $authHeader, $matches)) {
            $response->json(['error' => 'Unauthorized', 'message' => 'Token not provided or invalid format'], 401);
            exit;
        }

        $token = $matches[1];
        $payload = Security::verifyJWT($token);

        if (!$payload) {
            $response->json(['error' => 'Unauthorized', 'message' => 'Invalid or expired token'], 401);
            exit;
        }

        // Check if session is active in Redis
        try {
            $redis = \App\Core\RedisClient::getInstance();
            $userId = $payload['user_id'];
            $sessionState = $redis->get("session:{$userId}:{$token}");
            
            if (!$sessionState || $sessionState !== 'active') {
                $response->json(['error' => 'Unauthorized', 'message' => 'Session has been revoked or expired'], 401);
                exit;
            }
        } catch (\Exception $e) {
            // If Redis is down, we fallback to just JWT verification
            error_log("AuthMiddleware Redis Error: " . $e->getMessage());
        }

        // Validate required custom payload elements
        if (!isset($payload['user_id']) || !isset($payload['role'])) {
            $response->json(['error' => 'Unauthorized', 'message' => 'Malformed token payload structure'], 401);
            exit;
        }

        // Attach user info to the Request instance dynamically so controllers can use it
        $request->user_id = $payload['user_id'];
        $request->role = $payload['role'];
    }
}