authController.js

const jwt = require('jsonwebtoken');
const User = require('./User');

// Helper function: Create JWT token for user
const generateToken = (id) => {
  return jwt.sign({ id }, process.env.JWT_SECRET, {
    expiresIn: process.env.JWT_EXPIRE  // Token expires in 7 days
  });
};

// Register a new user
// Route: POST /api/auth/register
const register = async (req, res) => {
  try {
    // Step 1: Get name, email, password from request body
    const { name, email, password } = req.body;

    // Step 2: Check if all fields are provided
    if (!name || !email || !password) {
      return res.status(400).json({
        success: false,
        message: 'Please provide name, email, and password'
      });
    }

    // Step 3: Check if user with this email already exists
    const userExists = await User.findOne({ email });
    if (userExists) {
      return res.status(400).json({
        success: false,
        message: 'User already exists with this email'
      });
    }

    // Step 4: Create new user (password will be hashed automatically)
    const user = await User.create({ name, email, password });

    // Step 5: Generate JWT token for the user
    const token = generateToken(user._id);

    // Step 6: Send success response with user data and token
    res.status(201).json({
      success: true,
      message: 'User registered successfully',
      data: {
        _id: user._id,
        name: user.name,
        email: user.email,
        token  // Send token to frontend for authentication
      }
    });
  } catch (error) {
    res.status(500).json({
      success: false,
      message: 'Server error during registration',
      error: error.message
    });
  }
};

// Login existing user
// Route: POST /api/auth/login
const login = async (req, res) => {
  try {
    // Step 1: Get email and password from request
    const { email, password } = req.body;

    // Step 2: Check if both fields are provided
    if (!email || !password) {
      return res.status(400).json({
        success: false,
        message: 'Please provide email and password'
      });
    }

    // Step 3: Find user by email (include password for comparison)
    const user = await User.findOne({ email }).select('+password');
    if (!user) {
      return res.status(401).json({
        success: false,
        message: 'Invalid credentials'
      });
    }

    // Step 4: Check if password matches (uses bcrypt comparison)
    const isMatch = await user.matchPassword(password);
    if (!isMatch) {
      return res.status(401).json({
        success: false,
        message: 'Invalid credentials'
      });
    }

    // Step 5: Generate JWT token
    const token = generateToken(user._id);

    // Step 6: Send success response with token
    res.status(200).json({
      success: true,
      message: 'Login successful',
      data: {
        _id: user._id,
        name: user.name,
        email: user.email,
        token  // User needs this token for accessing protected routes
      }
    });
  } catch (error) {
    res.status(500).json({
      success: false,
      message: 'Server error during login',
      error: error.message
    });
  }
};

module.exports = {
  register,
  login
};