const jwt = require("jsonwebtoken")

module.exports = function requireUser(req, res, next) {
  const authHeader = req.headers.authorization

  if (!authHeader || !authHeader.startsWith("Bearer ")) {
    return res.status(401).json({ message: "No token provided" })
  }

  const token = authHeader.split(" ")[1]

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET)

    if (decoded.role !== "user") {
      return res.status(403).json({ message: "User access denied" })
    }

    req.user = decoded
    next()
  } catch {
    return res.status(401).json({ message: "Invalid or expired token" })
  }
}
