import { logApiError } from "@/lib/api/security";
import { NextResponse } from "next/server";
import { encryptSecret } from "@/lib/ai/crypto";
import { canManageWorkspace } from "@/lib/developers/auth";
import {
  exchangeGoogleCalendarCode,
  extractConnectedEmailFromCalendars,
  getGoogleCalendarRedirectUri,
  listGoogleCalendars,
  parseGoogleCalendarState,
} from "@/lib/integrations/google-calendar";
import { createAdminClient } from "@/lib/supabase/admin";
import { createRouteClient } from "@/lib/supabase/route";
import type { IntegrationConnection } from "@/types";

function integrationsRedirect(req: Request, status: string) {
  return new URL(`/integrations?googleCalendar=${encodeURIComponent(status)}`, new URL(req.url).origin);
}

export async function GET(req: Request) {
  try {
    const url = new URL(req.url);
    if (url.searchParams.get("error")) {
      return NextResponse.redirect(integrationsRedirect(req, "oauth_error"));
    }

    const code = url.searchParams.get("code");
    const stateValue = url.searchParams.get("state");
    if (!code || !stateValue) {
      return NextResponse.redirect(integrationsRedirect(req, "missing_code"));
    }

    const state = parseGoogleCalendarState(stateValue);
    if (Date.now() - state.issuedAt > 15 * 60 * 1000) {
      return NextResponse.redirect(integrationsRedirect(req, "state_expired"));
    }

    const supabase = await createRouteClient();
    const {
      data: { user },
    } = await supabase.auth.getUser();

    if (!user || user.id !== state.userId) {
      return NextResponse.redirect(integrationsRedirect(req, "session_mismatch"));
    }

    const manageable = await canManageWorkspace(user.id, state.teamId);
    if (!manageable) {
      return NextResponse.redirect(integrationsRedirect(req, "forbidden"));
    }

    const redirectUri = getGoogleCalendarRedirectUri(new URL(req.url).origin);
    const credentials = await exchangeGoogleCalendarCode({ code, redirectUri });
    const admin = createAdminClient();
    const tempConnection = {
      id: "temp-google-calendar",
      user_id: user.id,
      team_id: state.teamId,
      provider: "google_calendar",
      name: "Google Calendar",
      config: {},
      event_types: ["event.created", "event.updated", "event.deleted"],
      is_active: true,
      last_delivery_at: null,
      last_response_status: null,
      last_error: null,
      created_at: new Date().toISOString(),
      updated_at: new Date().toISOString(),
      secret_encrypted: encryptSecret(JSON.stringify(credentials)),
    } satisfies IntegrationConnection & { secret_encrypted: string };

    const calendars = await listGoogleCalendars(admin, tempConnection);
    const primaryCalendar = calendars.find((calendar) => calendar.primary) || calendars[0] || null;
    const connectedEmail = extractConnectedEmailFromCalendars(calendars);
    const nextSecret = encryptSecret(
      JSON.stringify({
        ...credentials,
        connected_email: connectedEmail,
      })
    );

    let existingQuery = admin
      .from("integration_connections")
      .select("id, name")
      .eq("provider", "google_calendar")
      .limit(1);
    existingQuery = state.teamId
      ? existingQuery.eq("team_id", state.teamId)
      : existingQuery.eq("user_id", user.id).is("team_id", null);

    const { data: existing } = await existingQuery.maybeSingle();

    if (existing) {
      await admin
        .from("integration_connections")
        .update({
          secret_encrypted: nextSecret,
          is_active: true,
          config: {
            calendarId: primaryCalendar?.id || null,
            calendarSummary: primaryCalendar?.summary || null,
            connectedEmail,
          },
          event_types: ["event.created", "event.updated", "event.deleted"],
        })
        .eq("id", existing.id);
    } else {
      await admin.from("integration_connections").insert({
        user_id: user.id,
        team_id: state.teamId,
        provider: "google_calendar",
        name: state.teamId ? "Team Google Calendar" : "Personal Google Calendar",
        config: {
          calendarId: primaryCalendar?.id || null,
          calendarSummary: primaryCalendar?.summary || null,
          connectedEmail,
        },
        secret_encrypted: nextSecret,
        event_types: ["event.created", "event.updated", "event.deleted"],
        is_active: true,
      });
    }

    return NextResponse.redirect(integrationsRedirect(req, "connected"));
  } catch (error) {
    logApiError("Google Calendar callback error:", error);
    return NextResponse.redirect(integrationsRedirect(req, "connect_failed"));
  }
}