import type { AuthRepository, AuthSession } from './auth-repository.js';
import { verifyAccessToken } from './jwt.js';

export interface AuthenticatedRequest {
  sessionId: string;
  session: AuthSession;
}

export async function authenticateAccessToken(
  authorization: string | undefined,
  repository: Pick<AuthRepository, 'validateSession'>,
  jwtSecret: string
): Promise<AuthenticatedRequest | null> {
  if (!authorization?.startsWith('Bearer ')) return null;
  try {
    const claims = verifyAccessToken(authorization.slice(7), jwtSecret);
    const session = await repository.validateSession(claims.sid, claims.tid, claims.sub);
    if (!session || session.platformAppId !== claims.aid || session.user.roleVersion !== claims.rv) {
      return null;
    }
    return { sessionId: claims.sid, session };
  } catch {
    return null;
  }
}