// lib/session.ts — session signée dans un cookie httpOnly (JWT)
import { SignJWT, jwtVerify } from "jose";
import { cookies } from "next/headers";

const secretKey = new TextEncoder().encode(process.env.SESSION_SECRET);

export async function createSession(userId: string) {
  const token = await new SignJWT({ userId })
    .setProtectedHeader({ alg: "HS256" })
    .setIssuedAt()
    .setExpirationTime("7d")
    .sign(secretKey);

  const cookieStore = await cookies();
  cookieStore.set("session", token, {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
    maxAge: 60 * 60 * 24 * 7,
  });
}

export async function getSession() {
  const cookieStore = await cookies();
  const token = cookieStore.get("session")?.value;
  if (!token) return null;

  try {
    const { payload } = await jwtVerify(token, secretKey);
    return payload as { userId: string };
  } catch {
    return null; // token expiré ou invalide
  }
}

export async function destroySession() {
  const cookieStore = await cookies();
  cookieStore.delete("session");
}

// app/login/actions.ts — Server Action de login
"use server";

import { redirect } from "next/navigation";
import { createSession } from "@/lib/session";
import { verifyCredentials } from "@/lib/auth";

export async function login(prevState: unknown, formData: FormData) {
  const email = formData.get("email") as string;
  const password = formData.get("password") as string;

  const user = await verifyCredentials(email, password);
  if (!user) {
    return { error: "Identifiants invalides" };
  }

  await createSession(user.id);
  redirect("/dashboard"); // redirection côté serveur après succès
}

// Protection au niveau du layout — vérifie la session pour toute la section
// app/dashboard/layout.tsx
import { redirect } from "next/navigation";
import { getSession } from "@/lib/session";

export default async function DashboardLayout({ children }: { children: React.ReactNode }) {
  const session = await getSession();
  if (!session) {
    redirect("/login");
  }

  return <div className="dashboard">{children}</div>;
}

// middleware.ts — première ligne de défense, avant même le rendu React
import { NextRequest, NextResponse } from "next/server";
import { jwtVerify } from "jose";

const secretKey = new TextEncoder().encode(process.env.SESSION_SECRET);

export async function middleware(request: NextRequest) {
  const token = request.cookies.get("session")?.value;

  if (!token) {
    return NextResponse.redirect(new URL("/login", request.url));
  }

  try {
    await jwtVerify(token, secretKey); // vérifie signature + expiration
    return NextResponse.next();
  } catch {
    const response = NextResponse.redirect(new URL("/login", request.url));
    response.cookies.delete("session");
    return response;
  }
}

export const config = {
  matcher: ["/dashboard/:path*", "/api/protected/:path*"],
};

// Accès aux données utilisateur dans un Server Component
import { getSession } from "@/lib/session";
import { db } from "@/lib/db";

export default async function ProfilePage() {
  const session = await getSession();
  const user = await db.query.users.findFirst({ where: (u, { eq }) => eq(u.id, session!.userId) });

  return <ProfileForm user={user} />;
}