const { inject } = require('../common/Provider');
const { verifyToken, createToken } = require('../utils/jwt');
const ignoreToken = ['/sign/check', '/sign/in', '/sign/up', '/sign/upwi', '/sign/forget', '/sign/send', '/sign/changePwd', '/sign/code'];
module.exports = {
    auth: inject(function (SysConfig) {
        const { JWT_SECRET } = SysConfig;
        return async (req, res, next) => {
            const token = req.headers.token;
            if(!ignoreToken.includes(req.path)) {
                if (token) {
                    const deToken = await verifyToken(token, JWT_SECRET);
                    if(deToken) {
                        res.locals.user = deToken.data;
                        // 换发新token，存在问题：如果上一个token没过期，其他人截获了的话，会不会被盗用？
                        res.set('token', createToken({
                            userId: deToken.userId
                        }, JWT_SECRET, {}));
                        return next();
                    }
                }
                return res.status(403).send('unauthorized');
            } else {
                next();
            }
        };
    })
};