backend/src/middleware/auth.ts

import type { NextFunction, Request, Response } from "express";
import { supabaseAdmin } from "../config/supabase";
import { HttpError } from "../utils/httpError";

export async function requireAuth(req: Request, _res: Response, next: NextFunction): Promise<void> {
  try {
    const header = req.header("authorization") ?? "";
    const [scheme, token] = header.split(" ");

    if (scheme?.toLowerCase() !== "bearer" || !token) {
      throw new HttpError(401, "auth_missing", "A Supabase bearer token is required");
    }

    const { data, error } = await supabaseAdmin.auth.getUser(token);
    if (error || !data.user) {
      throw new HttpError(401, "auth_invalid", "The Supabase bearer token is invalid");
    }

    req.authUser = data.user;
    req.accessToken = token;
    next();
  } catch (error) {
    next(error);
  }
}