export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { createAdminClient } from '@/lib/supabase/admin'
import { isValidRole } from '@/lib/auth/roles'
import { requireAdmin } from '@/lib/auth/require-admin'

export async function GET() {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const { data, error } = await supabase
    .from('users')
    .select('id, name, email, phone, role, department, site_id, active, created_at')
    .order('created_at', { ascending: false })

  if (error) return NextResponse.json({ error: 'Fetch failed' }, { status: 500 })
  return NextResponse.json(data ?? [])
}

export async function POST(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { email?: string; name?: string; phone?: string; role?: string; site_id?: string; password?: string } =
    await request.json().catch(() => ({}))
  const email = (body.email ?? '').trim().toLowerCase()
  if (!email || !email.includes('@'))
    return NextResponse.json({ error: 'Valid email required' }, { status: 422 })
  if (body.role && !isValidRole(body.role))
    return NextResponse.json({ error: 'Invalid role' }, { status: 422 })
  const password = (body.password ?? '').trim()
  if (!password)
    return NextResponse.json({ error: 'Password required' }, { status: 422 })
  if (password.length < 8)
    return NextResponse.json({ error: 'Password must be at least 8 characters' }, { status: 422 })

  let admin
  try {
    admin = createAdminClient()
  } catch {
    return NextResponse.json(
      { error: 'User creation unavailable: SUPABASE_SERVICE_ROLE_KEY not configured' },
      { status: 503 },
    )
  }

  const { data: created, error: createError } = await admin.auth.admin.createUser({
    email,
    password,
    email_confirm: true,
    user_metadata: { full_name: body.name ?? '' },
  })
  if (createError || !created?.user)
    return NextResponse.json(
      { error: createError?.message ?? 'User creation failed' },
      { status: (createError as { status?: number } | null)?.status ?? 500 },
    )
  const newUserId = created.user.id

  const { error: profileError } = await admin
    .from('users')
    .update({
      name: body.name ?? '',
      phone: (body.phone ?? '').trim() || null,
      role: body.role ?? 'reporter',
      site_id: body.site_id ?? null,
    })
    .eq('id', newUserId)
  if (profileError)
    return NextResponse.json(
      { error: 'User created but profile update failed' },
      { status: 500 },
    )

  await supabase.rpc('write_audit_log', {
    p_table_name: 'users',
    p_record_id: newUserId,
    p_action: 'created',
    p_new_value: { email, role: body.role ?? 'reporter', site_id: body.site_id ?? null },
  })

  return NextResponse.json({ id: newUserId }, { status: 201 })
}

export async function PATCH(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: {
    id?: string
    role?: string
    site_id?: string | null
    active?: boolean
    department?: string | null
  } = await request.json().catch(() => ({}))

  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
  if (body.role !== undefined && !isValidRole(body.role))
    return NextResponse.json({ error: 'Invalid role' }, { status: 422 })
  if (body.id === user.id && body.active === false)
    return NextResponse.json({ error: 'Cannot deactivate your own account' }, { status: 422 })
  if (body.id === user.id && body.role !== undefined && body.role !== 'admin')
    return NextResponse.json({ error: 'Cannot demote your own account' }, { status: 422 })

  const update: Record<string, unknown> = {}
  if (body.role !== undefined) update.role = body.role
  if (body.site_id !== undefined) update.site_id = body.site_id
  if (body.active !== undefined) update.active = body.active
  if (body.department !== undefined) update.department = body.department
  if (Object.keys(update).length === 0)
    return NextResponse.json({ error: 'Nothing to update' }, { status: 422 })

  const { data: before } = await supabase
    .from('users').select('role, site_id, active, department').eq('id', body.id).single()
  if (!before) return NextResponse.json({ error: 'User not found' }, { status: 404 })

  const { error } = await supabase.from('users').update(update).eq('id', body.id)
  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })

  await supabase.rpc('write_audit_log', {
    p_table_name: 'users',
    p_record_id: body.id,
    p_action: 'admin_update',
    p_old_value: before ?? null,
    p_new_value: update,
  })

  return NextResponse.json({ ok: true })
}

export async function DELETE(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const { searchParams } = new URL(request.url)
  const id = searchParams.get('id')
  if (!id) return NextResponse.json({ error: 'id required' }, { status: 422 })
  if (id === user.id)
    return NextResponse.json({ error: 'Cannot delete your own account' }, { status: 422 })

  // fetch user info for audit before deletion
  const { data: target } = await supabase
    .from('users').select('email, name, role').eq('id', id).single()

  let admin
  try {
    admin = createAdminClient()
  } catch {
    return NextResponse.json(
      { error: 'SUPABASE_SERVICE_ROLE_KEY not configured' },
      { status: 503 },
    )
  }

  const { error } = await admin.auth.admin.deleteUser(id)
  if (error)
    return NextResponse.json({ error: error.message ?? 'Deletion failed' }, { status: 500 })

  if (target) {
    await supabase.rpc('write_audit_log', {
      p_table_name: 'users',
      p_record_id: id,
      p_action: 'deleted',
      p_new_value: { email: target.email, name: target.name, role: target.role },
    })
  }

  return NextResponse.json({ ok: true })
}