import { adminAuth, adminDb } from './firebaseAdmin';
import { NextRequest } from 'next/server';

export interface AuthUser {
  uid: string;
  email: string;
  role: 'owner' | 'admin' | 'member';
}

export async function verifyRequest(req: NextRequest): Promise<AuthUser | null> {
  const authHeader = req.headers.get('Authorization');
  if (!authHeader?.startsWith('Bearer ')) return null;

  const idToken = authHeader.slice(7);
  try {
    const decoded = await adminAuth.verifyIdToken(idToken);
    const userSnap = await adminDb.doc(`users/${decoded.uid}`).get();
    if (!userSnap.exists) return null;
    const data = userSnap.data()!;
    return { uid: decoded.uid, email: decoded.email ?? '', role: data.role };
  } catch {
    return null;
  }
}

export function requireAdmin(user: AuthUser | null): boolean {
  return user !== null && ['owner', 'admin'].includes(user.role);
}

export async function checkRateLimit(
  identifier: string,
  limit: number,
  windowMs = 60 * 60 * 1000,
): Promise<boolean> {
  // _meta/<docId> → 2 segment = geçerli dokuman yolu
  const safeId = identifier.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 100);
  const ref = adminDb.doc(`_meta/rl_${safeId}`);
  const snap = await ref.get();
  const now = Date.now();

  if (!snap.exists) {
    await ref.set({ count: 1, windowStart: now });
    return true;
  }

  const d = snap.data()!;
  if (now - d.windowStart > windowMs) {
    await ref.set({ count: 1, windowStart: now });
    return true;
  }
  if (d.count >= limit) return false;
  await ref.update({ count: d.count + 1 });
  return true;
}