import { NextRequest, NextResponse } from 'next/server';
import { getSession } from '@/lib/auth';
import { revokeRefreshToken, revokeAllUserSessions } from '@/lib/tokens';
import { db, schema } from '@/lib/db';
import { eq } from 'drizzle-orm';
import { z } from 'zod';

const revokeSchema = z.object({
  sessionId: z.string().optional(),
  revokeAll: z.boolean().default(false),
  revokeFamily: z.boolean().default(false),
});

export async function POST(request: NextRequest) {
  try {
    // Authenticate user
    const session = await getSession(request.cookies.get('scriba.access_token')?.value);
    if (!session) {
      return NextResponse.json({ error: 'Non autorizzato' }, { status: 401 });
    }

    const body = await request.json();
    const parsed = revokeSchema.safeParse(body);
    
    if (!parsed.success) {
      return NextResponse.json({ error: 'Input non valido' }, { status: 400 });
    }

    const { sessionId, revokeAll, revokeFamily } = parsed.data;

    if (revokeAll) {
      // Revoke all sessions for the user except current one
      await revokeAllUserSessions(session.user.id, session.session.id);
      return NextResponse.json({ 
        success: true, 
        message: 'Tutte le sessioni sono state revocate' 
      });
    }

    if (sessionId) {
      // Verify the session belongs to the current user
      if (sessionId !== session.session.id) {
        // Check if the target session belongs to the same user
        const targetSession = await db.query.sessions.findFirst({
          where: eq(schema.sessions.id, sessionId)
        });

        if (!targetSession || targetSession.userId !== session.user.id) {
          return NextResponse.json({ error: 'Sessione non trovata' }, { status: 404 });
        }
      }

      // Revoke specific session (and optionally its family)
      await revokeRefreshToken(sessionId, revokeFamily);
      
      return NextResponse.json({ 
        success: true, 
        message: revokeFamily 
          ? 'Sessione e famiglia di token revocate' 
          : 'Sessione revocata' 
      });
    }

    return NextResponse.json({ error: 'Specificare sessionId o revokeAll' }, { status: 400 });
  } catch (error) {
    console.error('Session revoke error:', error);
    return NextResponse.json({ error: 'Revoca sessione fallita' }, { status: 500 });
  }
}

export async function GET(request: NextRequest) {
  try {
    // Authenticate user
    const session = await getSession(request.cookies.get('scriba.access_token')?.value);
    if (!session) {
      return NextResponse.json({ error: 'Non autorizzato' }, { status: 401 });
    }

    // Get all active sessions for the user
    const userSessions = await db.query.sessions.findMany({
      where: eq(schema.sessions.userId, session.user.id),
      orderBy: (sessions, { desc }) => [desc(sessions.createdAt)]
    });

    const sessions = userSessions.map(s => ({
      id: s.id,
      createdAt: s.createdAt,
      expiresAt: s.expiresAt,
      ipAddress: s.ipAddress,
      userAgent: s.userAgent,
      isCurrent: s.id === session.session.id,
      isRevoked: !!s.revokedAt,
      tokenFamily: s.tokenFamily,
    }));

    return NextResponse.json({ sessions });
  } catch (error) {
    console.error('Get sessions error:', error);
    return NextResponse.json({ error: 'Recupero sessioni fallito' }, { status: 500 });
  }
}