class ApplicationController < ActionController::API
    # Pay close attention... "authorized" is invoked first
    before_action :authorized

    # When this method encode_token is invoked later, 
    # an object is sent as the argument.
    # The method encode provided by the JWT gem will be utilized to generate a token. 
    # JWT.encode takes two arguments, the payload object and a string that represents a “secret”. 
    # The method encode_token will return the token generated by JWT.
    # To better understand how this works, look at the "authorized" method next.
    def encode_token(payload)
        JWT.encode(payload, 's3cr3t')
    end 

    def auth_header
        request.headers['Authorization'] 
        # Checking the "Authorization" key in headers
        # Ideally, a token generated by JWT in format of Bearer <token>
        # auth_header returns this
    end

    # auth_header 
    def decode_token
        if auth_header
            token = auth_header.split(' ')[1]
            # To get just the token, we will use the .split(" ")[1] method on 
            # Bearer <token> . Once the token is grabbed and assigned to the token 
            # variable, the decode method provided by JWT will be utilized.

            begin
                JWT.decode(token, 's3cr3t', true, algorithm: 'HS256')
                # JWT.decode takes in four arguments:
                # the token to decode, the secret string that was assigned when encoding, 
                # a true value, and the algorithm (‘HS256’ here). 
                # Otherwise, if there is an error, it will return nil.
            rescue JWT::DecodeError
                nil
            end
        end 
    end 

    # decoded_token is another method above being called, which calls auth_header
    def logged_in_user
        if decode_token
            user_id = decoded_token[0]['user_id']
            @user = User.find_by(id: user_id)
        end 
    end 

    # Great, now this method is checking another method above... logged_in_user;
    # true or false? (Boolean) ^
    def logged_in?
        !!logged_in_user
    end 

    # This method is invoked first, but is dependent on a chain of other methods above.
    # If a user is not logged in or a request is not sending the necessary credentials, 
    # this method will send back a JSON response, asking them to log in. To determine that 
    # information, the method logged_in? is called. Check that...
    def authorized
        render json: { message: 'Please log in'}, status: :unauthorized unless logged_in?
    end
end

class UsersController < ApplicationController
    # Invoked if ANY route is accessed in the application,
    # ... but only specific to the auto_login route.
    before_action :authorized, only: [:auto_login]

    # REGISTER
    def create 
        user = User.create(user_params)
        if user.valid?
            token = encode_token({user_id: @user.id})
            render json: {user: user, token: token}
        else 
            render json: {error: "Invalid username or password"}
        end 
    end 

    # LOGGING IN
    def login
        user = User.find_by(username: params[:username])

        if user&.authenticate(params[:password])
            token = encode_token({user_id: @user.id})
            render json: {user: @user, token: token}
        else 
            render json: {error: "Invalid username or password"}
        end 
    end

    # There’s really not much going on here. The big question is where the variable user comes from?
    # Since the method, authorized, will run before auto_login, the chain of methods in the application 
    # controller will also run. One of the methods, logged_in_user, will return a global @user variable 
    # that is accessible.
    def auto_login 
        render json: @user
    end 

    private

    def user_params
        params.require(:user).permit(:username, :password, :age)
    end 
end