import { NextRequest } from "next/server";
import crypto from "crypto";
import { constantTimeCompare } from "@/lib/security";

export function getExpectedToken(): string {
  const secret = process.env.ADMIN_PASSWORD || "admin123";
  if (!process.env.ADMIN_PASSWORD && process.env.NODE_ENV === "production") {
    console.warn("[SECURITY WARNING] ADMIN_PASSWORD is not set in environment variables! Using insecure default.");
  }
  return crypto.createHash("sha256").update(`booth-portal-session-${secret}`).digest("hex");
}

export function isAuthenticated(req: NextRequest): boolean {
  const cookieToken = req.cookies.get("booth_portal_token")?.value;
  const authHeader = req.headers.get("authorization");
  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : null;

  const expected = getExpectedToken();
  const tokenToTest = cookieToken || bearerToken || "";

  if (!tokenToTest) return false;

  return constantTimeCompare(tokenToTest, expected);
}