/**
 * @fileoverview Express auth middleware — populates req.auth.
 * @module middleware/authenticate
 */

import { extractBearerToken } from '../lib/tokens.js';
import { resolveAuthContext } from '../services/authService.js';
import { asyncHandler } from '../errors.js';
import { createDebugger } from '../debug/logger.js';

const log = createDebugger('auth');

/**
 * Resolve Bearer or x-api-key into `req.auth`.
 */
export const authenticate = asyncHandler(async (req, res, next) => {
  const rawToken =
    extractBearerToken(req.headers.authorization) ?? req.headers['x-api-key'] ?? null;

  req.auth = await resolveAuthContext(rawToken);
  log.debug('authenticated', {
    tenantId: req.auth.tenantId,
    method: req.auth.authMethod,
    plan: req.auth.tenant?.plan,
  });
  next();
});