const session = require('express-session');
const pgSession = require('connect-pg-simple')(session);
const pool = require('../db');

const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;

function createSessionMiddleware() {
  const secret = process.env.SESSION_SECRET;
  if (!secret) {
    console.warn(
      'SESSION_SECRET is not set — using insecure default (set SESSION_SECRET in production)'
    );
  }

  const secureCookie =
    process.env.SESSION_COOKIE_SECURE === '1' ||
    process.env.SESSION_COOKIE_SECURE === 'true';

  return session({
    store: new pgSession({
      pool,
      tableName: 'session',
      createTableIfMissing: false,
    }),
    name: 'gallery.sid',
    secret: secret || 'gallery-dev-insecure-session-secret',
    resave: false,
    saveUninitialized: false,
    cookie: {
      httpOnly: true,
      secure: secureCookie,
      sameSite: 'lax',
      maxAge: SEVEN_DAYS_MS,
    },
  });
}

module.exports = { createSessionMiddleware };