import { verifyAccessToken } from './jwt.js';
export function registerAuthMiddleware(app, jwtSecret) {
    app.decorateRequest('user', null);
    app.decorate('requireAuth', async function (request, reply) {
        const token = request.cookies?.access_token ||
            request.headers.authorization?.replace('Bearer ', '');
        if (!token) {
            return reply.code(401).send({ error: 'Authentication required' });
        }
        try {
            request.user = verifyAccessToken(token, jwtSecret);
        }
        catch {
            return reply.code(401).send({ error: 'Invalid or expired token' });
        }
    });
    app.decorate('requireRole', function (role) {
        return async function (request, reply) {
            if (request.user.role !== role) {
                return reply.code(403).send({ error: 'Insufficient permissions' });
            }
        };
    });
}
//# sourceMappingURL=auth-middleware.js.map