"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.verifyPassword = verifyPassword;
const bcryptjs_1 = __importDefault(require("bcryptjs"));
const db_1 = require("../../lib/db");
const crud_1 = require("./crud");
const sql_1 = require("./sql");
// ─── Password authentication ────────────────────────────────────────────────
/**
 * Verify a user's password. Returns the full user record (with roles)
 * on success, or null if the external_id doesn't exist, the user has
 * no password set, or the password doesn't match.
 */
async function verifyPassword(externalId, password) {
    const pool = (0, db_1.getPool)();
    const { rows } = await pool.query(sql_1.GET_USER_BY_EXTERNAL_ID, [externalId]);
    if (!rows[0] || !rows[0].password_hash)
        return null;
    const valid = await bcryptjs_1.default.compare(password, rows[0].password_hash);
    if (!valid)
        return null;
    return (0, crud_1.attachRoles)(rows[0]);
}
