const express = require('express');
const bcrypt = require('bcryptjs');
const db = require('../db');
const requireAuth = require('../middleware/auth');

const router = express.Router();

/* register */
router.post('/register', async (req, res) =>
{
   const { username, password } = req.body;
   if (!username || !password)
   {
      return res.status(400).json({ error: 'Username and password required' });
   }
   try
   {
      const existing = db.prepare('SELECT id FROM users WHERE username = ?').get(username);
      if (existing)
      {
         return res.status(409).json({ error: 'Username already taken' });
      }
      const hashed = bcrypt.hashSync(password, 10);
      const result = db.prepare('INSERT INTO users (username, password) VALUES (?, ?)').run(username, hashed);
      req.session.userId = result.lastInsertRowid;
      res.status(201).json({ id: result.lastInsertRowid, username });
   } catch (err)
   {
      res.status(500).json({ error: 'Registration failed' });
   }
});

/* login. */
router.post('/login', async (req, res) =>
{
   const { username, password } = req.body;
   if (!username || !password)
   {
      return res.status(400).json({ error: 'Username and password required' });
   }
   try
   {
      const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
      if (!user || !bcrypt.compareSync(password, user.password))
      {
         return res.status(401).json({ error: 'Invalid username or password' });
      }
      req.session.userId = user.id;
      res.json({ id: user.id, username: user.username });
   } catch (err)
   {
      res.status(500).json({ error: 'Login failed' });
   }
});

/* logout */
router.post('/logout', (req, res) =>
{
   req.session.destroy(() =>
   {
      res.clearCookie('connect.sid');
      res.json({ message: 'Logged out' });
   });
});

/* check session */
router.get('/check', (req, res) =>
{
   if (req.session.userId)
   {
      return res.json({ loggedIn: true });
   }
   res.status(401).json({ loggedIn: false });
});

module.exports = router;