// src/lib/auth-dal.ts
import type { UserIdentity, UserIdentityDAL } from "@waelhabbaldev/next-jwt-auth";
import db from "./db"; // Your database client
import { compare } from "bcrypt"; // Example password hashing library

// Define a type for your user identity that extends the base UserIdentity
export interface AppUserIdentity extends UserIdentity {
  id: number;
  email: string;
}

export const authDal: UserIdentityDAL<AppUserIdentity> = {
  // Find a user by their credentials (e.g., email and password)
  async fetchIdentityByCredentials(email, password) {
    const user = await db.user.findUnique({ where: { email } });
    if (!user) return null;

    const isPasswordValid = await compare(password, user.passwordHash);
    if (!isPasswordValid) return null;

    // Return the full user identity object on success
    return { ...user, roles: user.roles.split(',') };
  },

  // Find a user for an existing session
  async fetchIdentityForSession(identifier) {
    const user = await db.user.findUnique({ where: { id: Number(identifier) } });
    if (!user) return null;
    return { ...user, roles: user.roles.split(',') };
  },

  // Invalidate all sessions by incrementing the user's version
  async invalidateAllSessionsForIdentity(identifier) {
    await db.user.update({
      where: { id: Number(identifier) },
      data: { version: { increment: 1 } },
    });
  },

  // Check if a JTI has been used (replay attack defense)
  async isTokenJtiUsed(jti) {
    const token = await db.revokedToken.findUnique({ where: { jti } });
    return !!token;
  },

  // Mark a JTI as used
  async markTokenJtiAsUsed(jti, expirationInSeconds) {
    const expiresAt = new Date(Date.now() + expirationInSeconds * 1000);
    await db.revokedToken.create({ data: { jti, expiresAt } });
  },

  // Optional: Implement your TOTP or other MFA verification logic
  async verifyMFA(identifier, code) {
    // Example: const isValid = totp.verify({ token: code, ... });
    return true;
  },
};

// src/lib/auth.ts
import { createAuth } from "@waelhabbaldev/next-jwt-auth";
import { authDal, AppUserIdentity } from "./auth-dal";
import { checkRateLimit } from "./rate-limiter"; // Your rate limit logic

export const {
  createMiddleware,
  getSession,
  getCsrfToken,
  signIn,
  signOut,
  protectPage,
  protectAction,
  protectApi,
} = createAuth<AppUserIdentity>({
  // Required
  dal: authDal,
  baseUrl: process.env.BASE_URL!, // e.g., "http://localhost:3000"
  secrets: {
    accessTokenSecret: process.env.ACCESS_TOKEN_SECRET!,
    refreshTokenSecret: process.env.REFRESH_TOKEN_SECRET!,
  },
  
  cookies: {
    access: { name: "__at", maxAge: 15 * 60 }, // 15 minutes
    refresh: { name: "__rt", maxAge: 30 * 24 * 60 * 60 }, // 30 days
  },

  redirects: {
    unauthenticated: "/signin",
    unauthorized: "/dashboard?error=unauthorized",
    forbidden: "/signin?error=forbidden",
  },
  
  // Recommended Security Features
  refreshTokenRotationIntervalSeconds: 7 * 24 * 60 * 60, // 7 days
  csrfEnabled: true,
  
  // Optional Features
  rateLimit: checkRateLimit,
  debug: process.env.NODE_ENV === "development",
});

// middleware.ts
import { createMiddleware } from "./lib/auth";

export default createMiddleware();

export const config = {
  /**
   * Forces 'nodejs' runtime. Required for full Node.js APIs (e.g., database clients) 
   * as the default 'edge' runtime restricts I/O and networking features.
 */
  runtime:'nodejs',
  // Match all paths except for static assets and API routes.
  matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],
};

// app/actions.ts
"use server";
import { protectAction } from "@/lib/auth";
import { CsrfError } from "@waelhabbaldev/next-jwt-auth";

export async function sensitiveAction(formData: FormData) {
  try {
    // Pass the formData to enable the automatic CSRF check.
    const session = await protectAction(undefined, formData);
    // User is authenticated and authorized.
    // ... logic for the action ...
  } catch (error) {
    if (error instanceof CsrfError) {
      return { error: "Invalid CSRF token." };
    }
    // Handle other auth errors (NotAuthenticatedError, ForbiddenError)
  }
}

// app/api/projects/[id]/route.ts
import { protectApi } from "@/lib/auth";
import { NextResponse } from "next/server";

export async function GET(req, { params }) {
  const result = await protectApi();
  
  // If `response` is present, auth failed. Return it.
  if (result.response) return result.response;
  
  // `result.session` is guaranteed to be valid here.
  const { session } = result;
  
  return NextResponse.json({ data: `secret data for ${session.identity.email}` });
}

import { AuthProvider, useAuth } from '@waelhabbaldev/next-jwt-auth/client';

// app/auth/actions.ts
'use server';
import { getSession, signIn, signOut } from '@/lib/auth';
import { AuthError } from '@waelhabbaldev/next-jwt-auth';

// Action to get the current session
export async function getSessionAction() {
  return getSession();
}

// Action to sign in
export async function signInAction(identifier: string, secret: string) {
  try {
    return await signIn(identifier, secret);
  } catch (error) {
    if (error instanceof AuthError) {
      // Re-throw specific auth errors to be handled by the client
      throw error;
    }
    throw new Error('An unknown error occurred.');
  }
}

// Action to sign out
export async function signOutAction() {
  return signOut();
}