const jwt = require('jsonwebtoken');
const config = require('../config');

function auth(required = true) {
  return (req, res, next) => {
    const header = req.headers['authorization'] || '';
    const token = header.startsWith('Bearer ') ? header.slice(7) : null;

    if (!token) {
      if (required) return res.status(401).json({ error: 'Unauthorized' });
      req.user = null; return next();
    }

    try {
      const payload = jwt.verify(token, config.jwt.secret);
      req.user = payload; // { id, role, companyId }
      next();
    } catch (e) {
      return res.status(401).json({ error: 'Invalid token' });
    }
  };
}

module.exports = auth;
