const jwt = require('jsonwebtoken');
const User = require('../models/userModel');

module.exports = {
  protect: async (req, res, next) => {
    let token;

    if (
      req.headers.authorization &&
      req.headers.authorization.startsWith('Bearer')
    ) {
      try {
        token = req.headers.authorization.split(' ')[1];

        const decoded = jwt.verify(token, process.env.TOKEN_SECRET);
        req.user = await User.findById(decoded.id).select('-password');
        next();
      } catch (error) {
        console.error(error);
        res.status(401).json({
          message: 'Not authorized, token failed',
        });
      }
    }

    if (!token) {
      res.status(401).json({
        message: 'Not authorized, no token',
      });
    }
  },
};
