import { db, schema } from './db';
import { eq } from 'drizzle-orm';
import { verifyAccessToken } from './tokens';

/**
 * Validate a JWT access token and return the session + user if valid.
 * Returns null if token is invalid or expired.
 */
export async function getSession(accessToken: string | undefined) {
  if (!accessToken) return null;

  try {
    // Verify and decode the JWT access token
    const tokenPayload = verifyAccessToken(accessToken);
    if (!tokenPayload) return null;

    // Get the session from database to ensure it's still valid
    const session = await db.query.sessions.findFirst({
      where: eq(schema.sessions.id, tokenPayload.sessionId)
    });

    if (!session || session.revokedAt) {
      return null;
    }

    // Check expiration
    if (new Date(session.expiresAt) < new Date()) {
      // Clean up expired session
      await db.delete(schema.sessions).where(eq(schema.sessions.id, tokenPayload.sessionId));
      return null;
    }

    // Get user
    const user = await db.query.users.findFirst({
      where: eq(schema.users.id, tokenPayload.userId)
    });

    if (!user) return null;

    return { session, user };
  } catch (error) {
    console.error('Session validation error:', error);
    return null;
  }
}

/**
 * Legacy function for backward compatibility - validates session ID
 * This should be replaced with JWT-based validation
 */
export async function getSessionById(sessionId: string | undefined) {
  if (!sessionId) return null;

  try {
    const session = await db.query.sessions.findFirst({
      where: eq(schema.sessions.id, sessionId)
    });

    if (!session || session.revokedAt) return null;

    // Check expiration
    if (new Date(session.expiresAt) < new Date()) {
      // Clean up expired session
      await db.delete(schema.sessions).where(eq(schema.sessions.id, sessionId));
      return null;
    }

    // Get user
    const user = await db.query.users.findFirst({
      where: eq(schema.users.id, session.userId)
    });

    if (!user) return null;

    return { session, user };
  } catch (error) {
    console.error('Session validation error:', error);
    return null;
  }
}