// server/controller/authController.js
import bcrypt from "bcrypt";
import supabase from "../config/supabaseClient.js";

export const login = async (req, res) => {
    const { username, password } = req.body;

    try {
        // Fetch user by username
        const { data: user, error } = await supabase
            .from("employees") // your table name
            .select("*")
            .eq("username", username)
            .single();

        if (error || !user) {
            return res.status(400).json({ message: "User not found" });
        }

        // Check if password is hashed (length > 20 chars is a simple heuristic)
        if (user.password.length > 20) {
            // Hashed password
            const valid = await bcrypt.compare(password, user.password);
            if (!valid) return res.status(401).json({ message: "Invalid password" });
        } else {
            // Plain text fallback (temporary)
            if (password !== user.password)
                return res.status(401).json({ message: "Invalid password" });
        }

        // Success
        return res.status(200).json({
            id: user.id,
            username: user.username,
            full_name: user.full_name,
            role: user.role,
        });
    } catch (err) {
        console.error(err);
        return res.status(500).json({ message: "Server error" });
    }
};