import { NextRequest, NextResponse } from 'next/server';
import { createClient } from '@/lib/supabase/server';
import { createAdminClient } from '@/lib/supabase/admin';
import { badRequest, logApiError, readJsonBody } from '@/lib/api/security';

const SUPER_ADMIN_EMAIL = 'schmidtmartin930@gmail.com';

async function checkSuperAdmin() {
  const supabase = await createClient();
  const { data: { user } } = await supabase.auth.getUser();
  if (!user || user.email !== SUPER_ADMIN_EMAIL) return null;
  return user;
}

export async function GET() {
  const user = await checkSuperAdmin();
  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });

  const admin = createAdminClient();

  const { data: authUsers, error: authError } = await admin.auth.admin.listUsers();
  if (authError) {
    logApiError('Admin users auth list error', authError);
    return NextResponse.json({ error: 'Users could not be loaded' }, { status: 500 });
  }
  if (!authUsers?.users.length) return NextResponse.json([]);

  const userIds = authUsers.users.map(u => u.id);

  try {
    const [subsRes, adminRes, profilesRes] = await Promise.all([
      admin
        .from('user_subscriptions')
        .select('user_id, plan, status')
        .in('user_id', userIds),
      admin
        .from('admin_users')
        .select('*')
        .in('user_id', userIds),
      admin
        .from('profiles')
        .select('id, full_name, username')
        .in('id', userIds),
    ]);

    if (subsRes.error) throw subsRes.error;
    if (adminRes.error) throw adminRes.error;
    if (profilesRes.error) throw profilesRes.error;

    const subs = subsRes.data ?? [];
    const adminUsers = adminRes.data ?? [];
    const profiles = profilesRes.data ?? [];

    const rows = authUsers.users.map(u => {
      const sub = subs.find(s => s.user_id === u.id);
      const adminData = adminUsers.find(a => a.user_id === u.id);
      const profile = profiles.find(p => p.id === u.id);
      return {
        id: u.id,
        email: u.email ?? '',
        full_name: profile?.full_name ?? null,
        username: profile?.username ?? null,
        plan: sub?.plan ?? 'free',
        status: sub?.status ?? 'active',
        is_admin: !!adminData,
        admin_data: adminData ?? null,
      };
    });

    return NextResponse.json(rows);
  } catch (error) {
    logApiError('Admin users GET query error', error);
    return NextResponse.json({ error: 'Users could not be loaded' }, { status: 500 });
  }
}

export async function PATCH(req: NextRequest) {
  const user = await checkSuperAdmin();
  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });

  const body = await readJsonBody<{
    userId: string;
    plan: string;
    permissions: Record<string, boolean>;
  }>(req);
  if (!body) return badRequest('Invalid request body');

  const { userId, plan, permissions } = body;
  if (!userId) return NextResponse.json({ error: 'Missing userId' }, { status: 400 });
  if (typeof plan !== 'string' || !plan.trim()) {
    return NextResponse.json({ error: 'Invalid plan' }, { status: 400 });
  }
  if (!permissions || typeof permissions !== 'object' || Array.isArray(permissions)) {
    return NextResponse.json({ error: 'Invalid permissions' }, { status: 400 });
  }

  const hasAnyPerm = Object.values(permissions).some(Boolean);
  const admin = createAdminClient();

  try {
    // Upsert subscription
    const { error: subError } = await admin
      .from('user_subscriptions')
      .upsert({ user_id: userId, plan, status: 'active' }, { onConflict: 'user_id' });
    if (subError) throw subError;

    if (hasAnyPerm) {
      // Upsert admin_users with permissions
      const { error: adminError } = await admin
        .from('admin_users')
        .upsert(
          { user_id: userId, granted_by: user.id, ...permissions },
          { onConflict: 'user_id' },
        );
      if (adminError) throw adminError;
    } else {
      // Remove admin role entirely
      const { error: deleteError } = await admin
        .from('admin_users')
        .delete()
        .eq('user_id', userId);
      if (deleteError) throw deleteError;
    }

    return NextResponse.json({ ok: true });
  } catch (error) {
    logApiError('Admin users PATCH error', error);
    return NextResponse.json({ error: 'User could not be updated' }, { status: 500 });
  }
}