// ── Auth compatibility facade ──────────────────────────────────────────────
//
// The auth logic now lives in server/src/auth/ (token primitives, the session
// service, and session middleware). This module stays as a thin facade so every
// existing import site (auth.routes, admin.routes, siteMode, auth.controller)
// keeps working with the exact same names and behavior — nothing else in the
// codebase needs to change. New code should prefer requiring ../auth/* directly.

const token = require('../auth/token')
const sessionService = require('../auth/session.service')
const { requireAuth, requireRole } = require('../auth/session.middleware')

// Non-rejecting identity check. Returns the decoded token payload (with `.id`)
// or null — same shape callers relied on (siteMode only truthiness-checks it).
// Backed by the session service so there is a single validation path.
function getUserFromRequest(req) {
  const session = sessionService.validateSession(req)
  if (!session) return null
  // Preserve the historical payload shape (id/username/role) for callers.
  return { id: session.userId, username: session.username, role: session.role }
}

module.exports = {
  COOKIE_NAME: token.COOKIE_NAME,
  // Token primitives (re-exported from auth/token.js).
  signToken: token.signToken,
  verifyToken: token.verifyToken,
  signTotpChallenge: token.signTotpChallenge,
  verifyTotpChallenge: token.verifyTotpChallenge,
  setAuthCookie: token.setAuthCookie,
  clearAuthCookie: token.clearAuthCookie,
  // Request helpers / middleware.
  getUserFromRequest,
  isLoggedIn: requireAuth, // old name → new middleware, identical behavior
  requireRole,
}