package org.raddatz.familienarchiv.security;

import org.raddatz.familienarchiv.exception.DomainException;
import org.raddatz.familienarchiv.user.AppUser;
import org.raddatz.familienarchiv.user.UserService;
import org.springframework.security.core.Authentication;

import java.util.UUID;

// Cross-cutting auth helper; no domain home — "Utils" is the correct suffix here.
public final class SecurityUtils {

    private SecurityUtils() {}

    public static UUID requireUserId(Authentication authentication, UserService userService) {
        if (authentication == null || !authentication.isAuthenticated()) {
            throw DomainException.unauthorized("Authentication required");
        }
        AppUser user = userService.findByEmail(authentication.getName());
        if (user == null) {
            throw DomainException.unauthorized("User not found");
        }
        return user.getId();
    }
}
