ims/app/api/admin/users/route.ts

export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { createAdminClient } from '@/lib/supabase/admin'
import { isValidRole } from '@/lib/auth/roles'
import { requireAdmin } from '@/lib/auth/require-admin'

export async function GET() {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const { data, error } = await supabase
    .from('users')
    .select('id, name, email, phone, role, department, site_id, active, created_at')
    .order('created_at', { ascending: false })

  if (error) return NextResponse.json({ error: 'Fetch failed' }, { status: 500 })
  return NextResponse.json(data ?? [])
}

export async function POST(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { email?: string; name?: string; phone?: string; role?: string; site_id?: string; password?: string } =
    await request.json().catch(() => ({}))
  const email = (body.email ?? '').trim().toLowerCase()
  if (!email || !email.includes('@'))
    return NextResponse.json({ error: 'Valid email required' }, { status: 422 })
  if (body.role && !isValidRole(body.role))
    return NextResponse.json({ error: 'Invalid role' }, { status: 422 })
  const password = (body.password ?? '').trim()
  const directCreate = password.length > 0
  if (directCreate && password.length < 8)
    return NextResponse.json({ error: 'Password must be at least 8 characters' }, { status: 422 })

  let admin
  try {
    admin = createAdminClient()
  } catch {
    return NextResponse.json(
      { error: 'User invites unavailable: SUPABASE_SERVICE_ROLE_KEY not configured' },
      { status: 503 },
    )
  }

  // Branch: admin-typed password (instant) vs email invite (link required)
  let newUserId: string
  if (directCreate) {
    const { data: created, error: createError } = await admin.auth.admin.createUser({
      email,
      password,
      email_confirm: true,
      user_metadata: { full_name: body.name ?? '' },
    })
    if (createError || !created?.user)
      return NextResponse.json(
        { error: createError?.message ?? 'User creation failed' },
        { status: (createError as { status?: number } | null)?.status ?? 500 },
      )
    newUserId = created.user.id
  } else {
    const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? '').replace(/\/$/, '')
    if (!appUrl) {
      return NextResponse.json(
        { error: 'Invite unavailable: NEXT_PUBLIC_APP_URL not configured' },
        { status: 503 },
      )
    }
    const { data: invited, error: inviteError } = await admin.auth.admin.inviteUserByEmail(email, {
      data: { full_name: body.name ?? '' },
      redirectTo: `${appUrl}/api/auth/callback`,
    })
    if (inviteError || !invited?.user)
      return NextResponse.json({ error: inviteError?.message ?? 'Invite failed' }, { status: 500 })
    newUserId = invited.user.id
  }

  // handle_new_auth_user trigger creates the profile row; set fields on top of it
  const { error: profileError } = await admin
    .from('users')
    .update({
      name: body.name ?? '',
      phone: (body.phone ?? '').trim() || null,
      role: body.role ?? 'reporter',
      site_id: body.site_id ?? null,
    })
    .eq('id', newUserId)
  if (profileError)
    return NextResponse.json(
      { error: `${directCreate ? 'User created' : 'Invite sent'} but profile update failed` },
      { status: 500 },
    )

  // password is never logged
  await supabase.rpc('write_audit_log', {
    p_table_name: 'users',
    p_record_id: newUserId,
    p_action: directCreate ? 'created' : 'invited',
    p_new_value: { email, role: body.role ?? 'reporter', site_id: body.site_id ?? null },
  })

  return NextResponse.json({ id: newUserId }, { status: 201 })
}

export async function PATCH(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: {
    id?: string
    role?: string
    site_id?: string | null
    active?: boolean
    department?: string | null
  } = await request.json().catch(() => ({}))

  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
  if (body.role !== undefined && !isValidRole(body.role))
    return NextResponse.json({ error: 'Invalid role' }, { status: 422 })
  if (body.id === user.id && body.active === false)
    return NextResponse.json({ error: 'Cannot deactivate your own account' }, { status: 422 })
  if (body.id === user.id && body.role !== undefined && body.role !== 'admin')
    return NextResponse.json({ error: 'Cannot demote your own account' }, { status: 422 })

  const update: Record<string, unknown> = {}
  if (body.role !== undefined) update.role = body.role
  if (body.site_id !== undefined) update.site_id = body.site_id
  if (body.active !== undefined) update.active = body.active
  if (body.department !== undefined) update.department = body.department
  if (Object.keys(update).length === 0)
    return NextResponse.json({ error: 'Nothing to update' }, { status: 422 })

  const { data: before } = await supabase
    .from('users').select('role, site_id, active, department').eq('id', body.id).single()
  if (!before) return NextResponse.json({ error: 'User not found' }, { status: 404 })

  const { error } = await supabase.from('users').update(update).eq('id', body.id)
  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })

  await supabase.rpc('write_audit_log', {
    p_table_name: 'users',
    p_record_id: body.id,
    p_action: 'admin_update',
    p_old_value: before ?? null,
    p_new_value: update,
  })

  return NextResponse.json({ ok: true })
}