cannaiq/backend/src/routes/auth.ts

import { Router } from 'express';
import { authenticateUser, generateToken, authMiddleware, AuthRequest } from '../auth/middleware';

const router = Router();

// Login
router.post('/login', async (req, res) => {
  try {
    const { email, password } = req.body;
    
    if (!email || !password) {
      return res.status(400).json({ error: 'Email and password required' });
    }
    
    const user = await authenticateUser(email, password);
    
    if (!user) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }
    
    const token = generateToken(user);
    
    res.json({
      token,
      user: {
        id: user.id,
        email: user.email,
        role: user.role
      }
    });
  } catch (error) {
    console.error('Login error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Get current user
router.get('/me', authMiddleware, async (req: AuthRequest, res) => {
  res.json({
    user: req.user
  });
});

// Refresh token
router.post('/refresh', authMiddleware, async (req: AuthRequest, res) => {
  const token = generateToken(req.user!);
  res.json({ token });
});

// Verify password for sensitive actions (requires current user to be authenticated)
router.post('/verify-password', authMiddleware, async (req: AuthRequest, res) => {
  try {
    const { password } = req.body;

    if (!password) {
      return res.status(400).json({ error: 'Password required' });
    }

    // Re-authenticate the current user with the provided password
    const user = await authenticateUser(req.user!.email, password);

    if (!user) {
      return res.status(401).json({ error: 'Invalid password', verified: false });
    }

    res.json({ verified: true });
  } catch (error) {
    console.error('Password verification error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

export default router;