// 用户认证路由
const express = require('express');
const jwt = require('jsonwebtoken');
const { JWT_SECRET } = require('../middleware/auth');
const router = express.Router();

const USERS = {};
(process.env.USERS || '').split(',').forEach(u => {
  const [name, pass] = u.split(':').map(s => s.trim());
  if (name && pass) USERS[name] = pass;
});
const ADMINS = (process.env.ADMINS || '').split(',').map(s => s.trim()).filter(Boolean);

router.post('/login', (req, res) => {
  const { username, password } = req.body;
  if (USERS[username] && USERS[username] === password) {
    const token = jwt.sign({ username, isAdmin: ADMINS.includes(username) }, JWT_SECRET, { expiresIn: '7d' });
    return res.json({ token, username, isAdmin: ADMINS.includes(username) });
  }
  res.status(401).json({ error: '用户名或密码错误' });
});

router.get('/user', require('../middleware/auth').authMiddleware, (req, res) => {
  res.json({ username: req.user.username, isAdmin: req.user.isAdmin });
});

module.exports = router;