import { NextResponse } from "next/server";
import { auth } from "@/lib/auth";

export async function getAuthSession() {
  // Dev bypass: return a mock session pointing to the seeded dev user (never in production)
  if (process.env.DEV_BYPASS_AUTH === "true" && process.env.NODE_ENV !== "production") {
    const devUserId = process.env.DEV_USER_ID ?? "dev-user-001";
    return {
      session: {
        user: {
          id: devUserId,
          name: "Dev User",
          email: "dev@localhost",
          role: "ADMIN" as const,
          organizationId: "dev-org-001",
        },
        expires: new Date(Date.now() + 86400000).toISOString(),
      },
      error: null,
    };
  }

  const session = await auth();
  if (!session?.user?.id) {
    return { session: null, error: unauthorized() };
  }
  return { session, error: null };
}

export function unauthorized() {
  return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
}

export function badRequest(message: string) {
  return NextResponse.json({ error: message }, { status: 400 });
}

export function forbidden(message = "Forbidden") {
  return NextResponse.json({ error: message }, { status: 403 });
}

export function notFound(message = "Not found") {
  return NextResponse.json({ error: message }, { status: 404 });
}

export function serverError(error: unknown) {
  console.error(error);
  return NextResponse.json({ error: "Internal server error" }, { status: 500 });
}