import { logApiError } from "@/lib/api/security";
import { NextResponse } from "next/server";
import { encryptSecret } from "@/lib/ai/crypto";
import { canAccessWorkspace, canManageWorkspace } from "@/lib/developers/auth";
import { getGitHubViewer } from "@/lib/integrations/github";
import { createAdminClient } from "@/lib/supabase/admin";
import { createRouteClient } from "@/lib/supabase/route";

export async function GET(req: Request) {
  try {
    const supabase = await createRouteClient();
    const admin = createAdminClient();
    const {
      data: { user },
    } = await supabase.auth.getUser();

    if (!user) {
      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
    }

    const url = new URL(req.url);
    const teamId = url.searchParams.get("teamId");
    const accessible = await canAccessWorkspace(user.id, teamId);
    if (!accessible) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }

    let query = admin
      .from("integration_connections")
      .select(
        "id, user_id, team_id, provider, name, config, event_types, is_active, last_delivery_at, last_response_status, last_error, created_at, updated_at"
      )
      .eq("provider", "github")
      .order("created_at", { ascending: false });

    query = teamId ? query.eq("team_id", teamId) : query.is("team_id", null).eq("user_id", user.id);

    const { data, error } = await query;
    if (error) {
      return NextResponse.json({ error: error.message }, { status: 400 });
    }

    return NextResponse.json({ connections: data || [] });
  } catch (error) {
    logApiError("GitHub integrations GET error:", error);
    return NextResponse.json({ error: "Failed to load GitHub integrations" }, { status: 500 });
  }
}

export async function POST(req: Request) {
  try {
    const supabase = await createRouteClient();
    const {
      data: { user },
    } = await supabase.auth.getUser();

    if (!user) {
      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
    }

    const body = await req.json();
    const teamId = typeof body.teamId === "string" && body.teamId ? body.teamId : null;
    const manageable = await canManageWorkspace(user.id, teamId);

    if (!manageable) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }

    const token = typeof body.token === "string" ? body.token.trim() : "";
    const name = typeof body.name === "string" ? body.name.trim() : "";

    if (!token) {
      return NextResponse.json({ error: "A GitHub personal access token is required" }, { status: 400 });
    }

    const viewer = await getGitHubViewer(token);
    const defaultName = viewer.login ? `${viewer.login} GitHub` : "GitHub";

    const { data, error } = await supabase
      .from("integration_connections")
      .insert({
        user_id: user.id,
        team_id: teamId,
        provider: "github",
        name: name || defaultName,
        config: {
          connectedLogin: viewer.login,
          connectedUrl: viewer.html_url,
          repoOwner: null,
          repoName: null,
          repoFullName: null,
        },
        secret_encrypted: encryptSecret(token),
        event_types: [],
        is_active: body.isActive !== false,
      })
      .select(
        "id, user_id, team_id, provider, name, config, event_types, is_active, last_delivery_at, last_response_status, last_error, created_at, updated_at"
      )
      .single();

    if (error) {
      return NextResponse.json({ error: error.message }, { status: 400 });
    }

    return NextResponse.json({ connection: data });
  } catch (error) {
    logApiError("GitHub integrations POST error:", error);
    const message = error instanceof Error ? error.message : "Failed to create GitHub integration";
    return NextResponse.json({ error: message }, { status: 500 });
  }
}