import { NextRequest, NextResponse } from 'next/server';
import { isCrossOriginRequest } from '@/lib/sameOrigin';
import { sanitizeUserForClient } from '@/lib/auth';
import { LoginError, loginToBackend, logoutFromBackend } from '@/lib/backendLogin';
import {
  BACKEND_TOKEN_COOKIE_NAME, SESSION_COOKIE_NAME, SESSION_MAX_AGE,
  createSessionToken, getAuthenticatedHome, parseSessionToken, SessionConfigurationError,
} from '@/lib/session';

export const dynamic = 'force-dynamic';

const cookieOptions = {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  path: '/',
  sameSite: 'lax' as const,
};

function json(body: unknown, status = 200) {
  return NextResponse.json(body, { status, headers: { 'Cache-Control': 'private, no-store' } });
}

function clearSession(response: NextResponse) {
  for (const name of [SESSION_COOKIE_NAME, BACKEND_TOKEN_COOKIE_NAME,
    'electng_session_v1', 'aamovement_role', 'aamovement_id']) {
    response.cookies.set(name, '', { ...cookieOptions, maxAge: 0 });
  }
  return response;
}

async function requestUser(request: NextRequest) {
  return parseSessionToken(
    request.cookies.get(SESSION_COOKIE_NAME)?.value,
    request.cookies.get(BACKEND_TOKEN_COOKIE_NAME)?.value
  );
}

async function logout(request: NextRequest) {
  try {
    const token = request.cookies.get(BACKEND_TOKEN_COOKIE_NAME)?.value;
    if (token) await logoutFromBackend(token);
    return clearSession(json({ success: true, message: 'Logged out successfully' }));
  } catch (error: unknown) {
    if (error instanceof LoginError) return json({ error: error.message }, error.status);
    console.error('Logout failed:', error);
    return json({ error: 'Unable to sign out. Please try again.' }, 500);
  }
}

export async function GET(request: NextRequest) {
  const user = await requestUser(request);
  if (!user) {
    return clearSession(json({ authenticated: false, user: null }, 401));
  }
  return json({ authenticated: true, user: sanitizeUserForClient(user) });
}

export async function POST(request: NextRequest) {
  if (isCrossOriginRequest(request)) {
    return json({ error: 'Cross-origin authentication requests are not allowed.' }, 403);
  }

  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return json({ error: 'A valid JSON request body is required.' }, 400);
  }
  if (typeof body !== 'object' || body === null || !('action' in body)) {
    return json({ error: 'An authentication action is required.' }, 400);
  }

  if (body.action === 'logout') {
    return logout(request);
  }
  if (body.action !== 'login') {
    return json({ error: 'Unsupported authentication action. Sign in with your phone number and password.' }, 400);
  }

  try {
    const existingUser = await requestUser(request);
    if (existingUser) {
      return json({ error: 'You are already signed in.', redirect: getAuthenticatedHome(existingUser) }, 409);
    }
    const { phone_number, password, device_name = 'AAMovement Web' } = body as Record<string, unknown>;
    if (typeof phone_number !== 'string' || !phone_number.trim() ||
        typeof password !== 'string' || !password ||
        typeof device_name !== 'string' || !device_name.trim()) {
      return json({ error: 'Phone number, password and device name are required.' }, 400);
    }
    const { user, token } = await loginToBackend(phone_number.trim(), password, device_name.trim());
    const response = json({
      success: true,
      user: sanitizeUserForClient(user),
      redirect: getAuthenticatedHome(user),
    });
    response.cookies.set(SESSION_COOKIE_NAME, await createSessionToken(user, token),
      { ...cookieOptions, maxAge: SESSION_MAX_AGE });
    response.cookies.set(BACKEND_TOKEN_COOKIE_NAME, token, { ...cookieOptions, maxAge: SESSION_MAX_AGE });
    return response;
  } catch (error: unknown) {
    if (error instanceof LoginError) {
      return json({ error: error.message }, error.status);
    }
    if (error instanceof SessionConfigurationError) {
      console.error('Authentication is not configured:', error.message);
      return json({ error: 'Sign-in is not configured on this server. Rebuild the app (npm run build) and restart it.' }, 503);
    }
    console.error('Authentication failed:', error);
    return json({ error: 'Unable to create your session. Please try again.' }, 500);
  }
}

export async function DELETE(request: NextRequest) {
  if (isCrossOriginRequest(request)) {
    return json({ error: 'Cross-origin authentication requests are not allowed.' }, 403);
  }
  return logout(request);
}