const { admin } = require('./firebase_auth');

/**
 * Express middleware to verify Firebase App Check tokens.
 */
async function requireAppCheck(req, res, next) {
  const isEnforced = process.env.ENFORCE_APP_CHECK === 'true';
  const appCheckToken = req.header ? req.header('X-Firebase-AppCheck') : req.headers?.['x-firebase-appcheck'];

  if (!appCheckToken) {
    if (isEnforced) {
      return res.status(403).json({
        error: 'appCheckFailed',
        message: 'Missing X-Firebase-AppCheck header'
      });
    } else {
      return next();
    }
  }

  try {
    const appCheckClaims = await admin.appCheck().verifyToken(appCheckToken);
    req.appCheck = appCheckClaims;
    next();
  } catch (err) {
    if (isEnforced) {
      return res.status(403).json({
        error: 'appCheckFailed',
        message: 'Invalid App Check token'
      });
    } else {
      return next();
    }
  }
}

module.exports = { requireAppCheck };