import { NextRequest, NextResponse } from 'next/server';
import { db, schema } from '@/lib/db';
import { eq, and, sql } from 'drizzle-orm';
import { updateCompanySchema } from '@/lib/validators';
import { getSession } from '@/lib/auth';
import { isCompanyOwner, getCompanyById, countCompanyConversions, getEffectiveMaxConversions, initialLicenseCreditsForPackage } from '@/lib/companies';
import type { PackageTier } from '@/lib/companies';
import { getMaxUsersForPackage } from '@/lib/companies';

/**
 * GET /api/companies/[id]
 * Get detailed company information
 * - Owner: full access including financial data
 * - Company member: limited info
 * - Outside: denied
 */
export async function GET(
  request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  try {
    const { id } = await params;

    // Verify authentication
    const accessToken = request.cookies.get('scriba.access_token')?.value;
    const sessionData = await getSession(accessToken);

    if (!sessionData) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const { user } = sessionData;

    // Verify user belongs to this company
    if (user.companyId !== id) {
      return NextResponse.json(
        { error: 'Access denied. You are not a member of this company.' },
        { status: 403 }
      );
    }

    // Get company
    const company = await getCompanyById(id);
    if (!company) {
      return NextResponse.json({ error: 'Company not found' }, { status: 404 });
    }

    // Check if user is owner
    const isOwner = await isCompanyOwner(user.id, id);

    // Get user count
    const userCountResult = await db
      .select({ count: sql<number>`count(*)` })
      .from(schema.users)
      .where(eq(schema.users.companyId, id));
    const userCount = userCountResult[0]?.count || 0;
    const conversionCount = await countCompanyConversions(id);
    const maxConversions = getEffectiveMaxConversions(company);

    if (isOwner) {
      // Owner sees all data including users
      const users = await db.query.users.findMany({
        where: eq(schema.users.companyId, id),
        columns: {
          id: true,
          email: true,
          name: true,
          role: true,
          isOwner: true,
          createdAt: true,
          twoFactorEnabled: true,
        },
      });

      return NextResponse.json({
        company: {
          id: company.id,
          name: company.name,
          package: company.package,
          maxUsers: company.maxUsers,
          maxConversions,
          extraConversionSlots: company.extraConversionSlots,
          ownerId: company.ownerId,
          financialData: company.financialData,
          paymentMethod: company.paymentMethod,
          stripeCustomerId: company.stripeCustomerId,
          userCount,
          remainingSlots: company.maxUsers - userCount,
          conversionCount,
          remainingConversions: Math.max(0, maxConversions - conversionCount),
          users,
          createdAt: company.createdAt,
          updatedAt: company.updatedAt,
        },
        isOwner: true,
      });
    } else {
      // Regular user sees limited data
      return NextResponse.json({
        company: {
          id: company.id,
          name: company.name,
          package: company.package,
          maxUsers: company.maxUsers,
          maxConversions,
          extraConversionSlots: company.extraConversionSlots,
          userCount,
          conversionCount,
          remainingConversions: Math.max(0, maxConversions - conversionCount),
          createdAt: company.createdAt,
        },
        isOwner: false,
      });
    }

  } catch (error) {
    console.error('Get company error:', error);
    return NextResponse.json(
      { error: 'Failed to retrieve company' },
      { status: 500 }
    );
  }
}

/**
 * PATCH /api/companies/[id]
 * Update company details
 * - Owner only
 */
export async function PATCH(
  request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  try {
    const { id } = await params;

    // Verify authentication
    const accessToken = request.cookies.get('scriba.access_token')?.value;
    const sessionData = await getSession(accessToken);

    if (!sessionData) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const { user } = sessionData;

    // Verify ownership
    const isOwner = await isCompanyOwner(user.id, id);
    if (!isOwner) {
      return NextResponse.json(
        { error: 'Only the company owner can update company details' },
        { status: 403 }
      );
    }

    // Parse and validate request body
    const body = await request.json();
    const parsed = updateCompanySchema.safeParse(body);

    if (!parsed.success) {
      return NextResponse.json(
        { error: parsed.error.issues[0]?.message ?? 'Invalid input' },
        { status: 400 }
      );
    }

    const updates = parsed.data;

    // Build update object
    const updateData: Partial<typeof schema.companies.$inferInsert> = {
      updatedAt: new Date(),
    };

    if (updates.name) updateData.name = updates.name;
    if (updates.package) {
      updateData.package = updates.package;
      // Recalculate maxUsers when package changes
      updateData.maxUsers = getMaxUsersForPackage(updates.package as PackageTier);
      updateData.licenseCreditsRemaining = initialLicenseCreditsForPackage(updates.package);
    }
    if (updates.maxUsers) updateData.maxUsers = updates.maxUsers;

    // Update company
    const [updated] = await db
      .update(schema.companies)
      .set(updateData)
      .where(eq(schema.companies.id, id))
      .returning();

    if (!updated) {
      return NextResponse.json(
        { error: 'Company not found' },
        { status: 404 }
      );
    }

    return NextResponse.json({
      success: true,
      company: {
        id: updated.id,
        name: updated.name,
        package: updated.package,
        maxUsers: updated.maxUsers,
        updatedAt: updated.updatedAt,
      },
    });

  } catch (error) {
    console.error('Update company error:', error);
    return NextResponse.json(
      { error: 'Failed to update company' },
      { status: 500 }
    );
  }
}

/**
 * DELETE /api/companies/[id]
 * Delete a company
 * - Owner only
 * - This will cascade delete all users due to FK constraint
 */
export async function DELETE(
  request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  try {
    const { id } = await params;

    // Verify authentication
    const accessToken = request.cookies.get('scriba.access_token')?.value;
    const sessionData = await getSession(accessToken);

    if (!sessionData) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const { user } = sessionData;

    // Verify ownership
    const isOwner = await isCompanyOwner(user.id, id);
    if (!isOwner) {
      return NextResponse.json(
        { error: 'Only the company owner can delete the company' },
        { status: 403 }
      );
    }

    // Delete company (cascade will handle users)
    await db.delete(schema.companies).where(eq(schema.companies.id, id));

    return NextResponse.json({
      success: true,
      message: 'Company deleted successfully',
    });

  } catch (error) {
    console.error('Delete company error:', error);
    return NextResponse.json(
      { error: 'Failed to delete company' },
      { status: 500 }
    );
  }
}