const express = require('express');
const { body, validationResult } = require('express-validator');
const db = require('../db-sqlite');
const { hashPassword, verifyPassword, generateToken, verifyToken } = require('../utils/auth');
const { authenticate, optionalAuth, requireRole, requireAdmin } = require('../middleware/auth');

const validate = (req, res, next) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ 
      success: false, 
      errors: errors.array() 
    });
  }
  next();
};

module.exports = function(app) {
  const router = express.Router();

  router.post('/login', async (req, res) => {
    try {
      const { username, password } = req.body;
      
      if (!username || !password) {
        return res.status(400).json({
          success: false,
          message: '用户名和密码不能为空'
        });
      }
      
      const result = await db.query(
        'SELECT id, username, name, email, phone, role, password_hash FROM users WHERE username = ?',
        [username]
      );
      
      if (!result || result.rows.length === 0) {
        return res.status(401).json({
          success: false,
          message: '用户名或密码错误'
        });
      }
      
      const user = result.rows[0];
      
      let isValidPassword = false;
      if (user.password_hash) {
        isValidPassword = verifyPassword(password, user.password_hash);
      } else {
        isValidPassword = (user.password === password);
      }
      
      if (!isValidPassword) {
        return res.status(401).json({
          success: false,
          message: '用户名或密码错误'
        });
      }
      
      const token = generateToken(user);
      
      res.json({
        success: true,
        token,
        user: {
          id: user.id,
          username: user.username,
          name: user.name,
          email: user.email,
          phone: user.phone,
          role: user.role
        }
      });
    } catch (error) {
      console.error('登录失败:', error);
      res.status(500).json({ success: false, message: '登录失败' });
    }
  });

  router.get('/verify', authenticate, async (req, res) => {
    try {
      const user = req.user;
      
      if (!user) {
        return res.status(401).json({ success: false, message: '未授权' });
      }
      
      res.json({
        success: true,
        user: {
          id: user.id,
          username: user.username,
          name: user.name,
          email: user.email,
          phone: user.phone,
          role: user.role
        }
      });
    } catch (error) {
      console.error('验证失败:', error);
      res.status(500).json({ success: false, message: '验证失败' });
    }
  });

  router.post('/logout', authenticate, async (req, res) => {
    try {
      res.json({
        success: true,
        message: '登出成功'
      });
    } catch (error) {
      console.error('登出失败:', error);
      res.status(500).json({ success: false, message: '登出失败' });
    }
  });

  app.use('/api/auth', router);
};