import { NextRequest, NextResponse } from 'next/server';
import { db, schema } from '@/lib/db';
import { eq } from 'drizzle-orm';
import { getSession } from '@/lib/auth';
import { testConnection } from '@/lib/fatture-in-cloud';

export const runtime = 'nodejs';

async function requireAdmin(request: NextRequest) {
  const accessToken = request.cookies.get('scriba.access_token')?.value;
  const session = await getSession(accessToken);
  if (!session) return null;

  const user = await db.query.users.findFirst({ where: eq(schema.users.id, session.user.id) });
  if (!user || user.role !== 'admin') return null;

  return user;
}

function mask(value: string | null | undefined): string {
  if (!value) return '';
  return value.length <= 8 ? '••••••••' : `${value.slice(0, 4)}${'•'.repeat(value.length - 8)}${value.slice(-4)}`;
}

/**
 * GET /api/admin/fatture-in-cloud          — returns current config (secrets masked)
 * GET /api/admin/fatture-in-cloud?test=1   — runs a live connection test, no DB writes
 */
export async function GET(request: NextRequest) {
  const user = await requireAdmin(request);
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 });

  if (request.nextUrl.searchParams.get('test') === '1') {
    const result = await testConnection();
    return NextResponse.json(result);
  }

  const row = await db.query.ficSettings.findFirst({
    where: eq(schema.ficSettings.id, 'default'),
  });

  return NextResponse.json({
    configured: !!(row?.clientId && row.clientSecret && row.companyId),
    clientId: row?.clientId ?? '',
    clientSecretMasked: mask(row?.clientSecret),
    companyId: row?.companyId ?? '',
    vatId: row?.vatId ?? '0',
    hasAccessToken: !!row?.accessToken,
    accessTokenMasked: mask(row?.accessToken),
    hasRefreshToken: !!row?.refreshToken,
    expiresAt: row?.expiresAt?.toISOString() ?? null,
    updatedAt: row?.updatedAt?.toISOString() ?? null,
  });
}

/**
 * POST /api/admin/fatture-in-cloud
 * Save FIC config. Empty string for a secret field means "keep existing value".
 * Optionally test the connection after saving.
 */
export async function POST(request: NextRequest) {
  const user = await requireAdmin(request);
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 });

  const body = await request.json() as {
    clientId?: string;
    clientSecret?: string;
    companyId?: string;
    vatId?: string;
    accessToken?: string;
    refreshToken?: string;
  };

  const existing = await db.query.ficSettings.findFirst({
    where: eq(schema.ficSettings.id, 'default'),
  });

  const update = {
    clientId:     body.clientId     !== undefined ? body.clientId     : (existing?.clientId     ?? null),
    clientSecret: body.clientSecret ? body.clientSecret               : (existing?.clientSecret ?? null),
    companyId:    body.companyId    !== undefined ? body.companyId    : (existing?.companyId    ?? null),
    vatId:        body.vatId        !== undefined ? body.vatId        : (existing?.vatId        ?? '0'),
    accessToken:  body.accessToken  ? body.accessToken                : (existing?.accessToken  ?? null),
    refreshToken: body.refreshToken ? body.refreshToken               : (existing?.refreshToken ?? null),
    // FIC OAuth access tokens last 24h; manual auth tokens never expire (we set null for those)
    expiresAt:    body.accessToken
      ? new Date(Date.now() + 86_400_000)
      : (existing?.expiresAt ?? null),
    updatedAt: new Date(),
  };

  if (existing) {
    await db.update(schema.ficSettings).set(update).where(eq(schema.ficSettings.id, 'default'));
  } else {
    await db.insert(schema.ficSettings).values({ id: 'default', ...update });
  }

  return NextResponse.json({ saved: true });
}

/**
 * DELETE /api/admin/fatture-in-cloud/tokens
 * Clears stored tokens so the admin can re-paste fresh ones.
 */
export async function DELETE(request: NextRequest) {
  const user = await requireAdmin(request);
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 });

  await db.update(schema.ficSettings)
    .set({ accessToken: null, refreshToken: null, expiresAt: null, updatedAt: new Date() })
    .where(eq(schema.ficSettings.id, 'default'));

  return NextResponse.json({ cleared: true });
}