const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');

const authUser = async (req, res, { user, databasePassword, password, UserPasswordModel }) => {
  if (!databasePassword?.salt || !databasePassword?.password) {
    return res.status(409).json({
      success: false,
      result: null,
      message: 'Your account password has not been configured yet.',
    });
  }

  const isMatch = await bcrypt.compare(databasePassword.salt + password, databasePassword.password);

  if (!isMatch) {
    user.activitySummary = {
      ...(user.activitySummary || {}),
      lastAuthEvent: 'login_failed',
      lastAuthAt: new Date(),
    };
    await user.save();
    return res.status(403).json({
      success: false,
      result: null,
      message: 'Invalid credentials.',
    });
  }

  if (isMatch === true) {
    user.lastLoginAt = new Date();
    user.lastLoginIp =
      req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
      req.socket?.remoteAddress ||
      req.ip ||
      null;
    user.activitySummary = {
      ...(user.activitySummary || {}),
      lastAuthEvent: 'login_success',
      lastAuthAt: user.lastLoginAt,
    };
    await user.save();

    const token = jwt.sign(
      {
        id: user._id,
      },
      process.env.JWT_SECRET,
      { expiresIn: req.body.remember ? 365 * 24 + 'h' : '24h' }
    );

    await UserPasswordModel.findOneAndUpdate(
      { user: user._id },
      { $push: { loggedSessions: token } },
      {
        new: true,
      }
    ).exec();

    // .cookie(`token_${user.cloud}`, token, {
    //     maxAge: req.body.remember ? 365 * 24 * 60 * 60 * 1000 : null,
    //     sameSite: 'None',
    //     httpOnly: true,
    //     secure: true,
    //     domain: req.hostname,
    //     path: '/',
    //     Partitioned: true,
    //   })
    res.status(200).json({
      success: true,
      result: {
        _id: user._id,
        name: user.name,
        surname: user.surname,
        role: user.role,
        roleRefs: user.roleRefs,
        permissions: user.permissions,
        deniedFields: user.deniedFields,
        tenant: user.tenant,
        email: user.email,
        photo: user.photo,
        enabled: user.enabled,
        lastLoginAt: user.lastLoginAt,
        token: token,
        maxAge: req.body.remember ? 365 : null,
      },
      message: 'Successfully login user',
    });
  } else {
    return res.status(403).json({
      success: false,
      result: null,
      message: 'Invalid credentials.',
    });
  }
};

module.exports = authUser;
