import os
import jwt
from jwt import ExpiredSignatureError, InvalidTokenError


def verify_token(token: str) -> dict:
    """Verify and decode a JWT signed by NestJS (HS256).

    Raises:
        ValueError: If the token is invalid, expired, or the salon is suspended/deleted.
    """
    secret = os.getenv("JWT_SECRET")
    if not secret:
        raise ValueError("JWT_SECRET environment variable is required")

    try:
        payload = jwt.decode(token, secret, algorithms=["HS256"])
    except ExpiredSignatureError:
        raise ValueError("Token has expired") from None
    except InvalidTokenError:
        raise ValueError("Invalid token") from None

    if payload.get("is_suspended"):
        raise ValueError("Salon is suspended")

    if payload.get("is_deleted"):
        raise ValueError("Salon is deleted")

    return payload


def authenticate_request(auth_header: str | None) -> dict:
    """Extract and verify a Bearer token from an Authorization header."""
    if not auth_header:
        raise ValueError("Authorization header missing")

    parts = auth_header.split()
    if len(parts) != 2 or parts[0].lower() != "bearer":
        raise ValueError("Invalid authorization header")

    return verify_token(parts[1])