import { Request, Response, NextFunction } from 'express';
import { EmbedService } from '../services/EmbedService';

const embedService = new EmbedService();

export async function validateEmbedOrigin(
  req: Request,
  res: Response,
  next: NextFunction,
): Promise<void> {
  try {
    const embedKey = req.params.embedKey;
    const origin = req.headers.origin ?? req.headers.referer ?? '';

    const config = await embedService.getConfig(embedKey);
    if (!config) {
      res.status(404).json({ error: 'embed_not_found', message: 'Embed configuration not found.' });
      return;
    }

    if (!embedService.isOriginAllowed(origin, config.allowedOrigins)) {
      res.status(403).json({ error: 'origin_not_allowed', message: 'Origin not allowed.' });
      return;
    }

    req.embedConfig = config;
    next();
  } catch (err) {
    next(err);
  }
}