from sqlalchemy.orm import Session

from app.models import User, UserRole
from app.schemas import RoleEnum
from app.security import create_access_token, verify_password


def authenticate(db: Session, email: str, password: str) -> User | None:
    user = db.query(User).filter(User.email == email).first()
    if not user or not verify_password(password, user.hashed_password):
        return None
    return user


def issue_token_for(user: User) -> str:
    role = RoleEnum.admin if user.role == UserRole.admin else RoleEnum.user
    return create_access_token(user_id=user.id, role=role)