import hashlib
import hmac
import json
import time
from flask import request

_SECRET = b"ecom-secret-2026"

_USERS = {
    "tok_alice_001": {"sub": "user-1", "name": "Alice",  "roles": ["buyer"]},
    "tok_bob_002":   {"sub": "user-2", "name": "Bob",    "roles": ["buyer", "seller"]},
    "tok_admin_999": {"sub": "user-0", "name": "Admin",  "roles": ["admin"]},
}


def _verify_token(token: str) -> dict | None:
    if token in _USERS:
        return _USERS[token]
    return None


def main():
    token = request.headers.get("x-bearer-token", "").strip()
    if not token:
        auth_header = request.headers.get("authorization", "")
        token = auth_header.removeprefix("Bearer ").strip()

    if not token:
        return {"status": 401, "body": json.dumps({"error": "missing token"}),
                "headers": {"Content-Type": "application/json"}}

    user = _verify_token(token)
    if not user:
        return {"status": 403, "body": json.dumps({"error": "invalid token"}),
                "headers": {"Content-Type": "application/json"}}

    payload = {
        "authenticated": True,
        "sub": user["sub"],
        "name": user["name"],
        "roles": user["roles"],
        "checked_at": int(time.time()),
    }
    return json.dumps(payload)