import { verifyAccessToken } from "../utils/jwt.js";

export function authenticate(req, res, next) {
  const header = req.headers.authorization || "";
  const token = header.startsWith("Bearer ") ? header.slice(7) : "";
  if (!token) return res.status(401).json({ error: "Nicht angemeldet" });
  try {
    req.user = verifyAccessToken(token);
    next();
  } catch {
    res.status(401).json({ error: "Ungültiges Token" });
  }
}

export function requireMfa(req, res, next) {
  if (!req.user?.mfa_verified) return res.status(403).json({ error: "MFA erforderlich" });
  next();
}
