auth_middleware.php

<?php

// 1. Include the autoloader so we can handle token decoding
require_once __DIR__ . '/vendor/autoload.php';
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

function authenticate_user($pdo) {
    // 2. Extract the HTTP Authorization Header
    $headers = getallheaders();
    $authHeader = $headers['Authorization'] ?? $headers['authorization'] ?? null;

    if (!$authHeader) {
        http_response_code(401);
        echo json_encode(["error" => "Authorization header missing"]);
        exit;
    }

    // 3. Extract the clean token from the 'Bearer <token>' format
    if (!preg_match('/Bearer\s(\S+)/', $authHeader, $matches)) {
        http_response_code(401);
        echo json_encode(["error" => "Invalid authorization header format. Use 'Bearer <token>'"]);
        exit;
    }
    
    $jwt = $matches[1];
    $jwtSecret = $_ENV['JWT_SECRET'] ?? null;

    try {
        // 4. Decode and cryptographically verify the token signatures
        $decoded = JWT::decode($jwt, new Key($jwtSecret, 'HS256'));
        
        // 5. Convert the decoded object properties into a clean associative array
        $claims = (array) $decoded;

        // 6. Cross-verify against the database to guarantee the user still exists
        $stmt = $pdo->prepare("SELECT id, username FROM users WHERE username = :username");
        $stmt->execute([':username' => $claims['sub']]);
        $user = $stmt->fetch();

        if (!$user) {
            http_response_code(401);
            echo json_encode(["error" => "User record no longer exists"]);
            exit;
        }

        // 7. Return the verified user array data to the calling route handler
        return $user;

    } catch (\Exception $e) {
        // Catch expired or tampered signatures safely
        http_response_code(401);
        echo json_encode(["error" => "Token verification failed: " . $e->getMessage()]);
        exit;
    }
}