package email

import (
	"github.com/gin-gonic/gin"

	"clapclap/internal/apperr"
	"clapclap/internal/ginctx"
)

// WARNING: This must be placed AFTER JwtAccessAuth!
func RequireVerification(c *gin.Context) {
	userUUID, err := ginctx.GetUUID(c, "userID")
	if err != nil {
		apperr.AbortWithError(c, apperr.NewUnauthorizedError(err))
		return
	}

	repo, err := ginctx.GetRepo(c, "repo")
	if err != nil {
		apperr.AbortWithError(c, apperr.NewInternalServerError(err))
		return
	}

	user, err := repo.GetUserByID(userUUID, nil)
	if err != nil {
		apperr.AbortWithError(c, apperr.NewDatabaseError(err, "User not found"))
		return
	}

	if !user.IsVerified {
		apperr.AbortWithError(c, apperr.NewForbiddenError(nil, "Account restricted. Please verify your email address."))
		return
	}

	c.Next()
}