import { adminLoginCommandSchema } from "@salixcommerce/core";
import type { NextRequest } from "next/server";
import { validateJsonMutationRequest } from "@/server/commerce/http";
import { adminAuthConfigured, adminRepository } from "@/server/admin/admin";
import { authorizeAdminMembership } from "@/server/admin/authorization";
import { adminFailureResponse, adminJson } from "@/server/admin/http";
import { adminFailure } from "@/server/admin/repository";
import { createAdminAuthClient } from "@/server/admin/supabase-session";

export async function POST(request: NextRequest) {
  const gate = validateJsonMutationRequest(request);
  if (!gate.ok) return gate.response;
  const input = adminLoginCommandSchema.safeParse(await request.json().catch(() => null));
  if (!input.success)
    return adminJson(
      { error: { code: "INVALID_REQUEST", message: "Invalid sign-in request." }, ok: false },
      400,
    );
  if (!adminAuthConfigured)
    return adminFailureResponse(
      adminFailure("ADMIN_UNAVAILABLE", "Administration is not configured.", 503),
    );
  const client = await createAdminAuthClient();
  if (client === null)
    return adminFailureResponse(
      adminFailure("ADMIN_UNAVAILABLE", "Administration is not configured.", 503),
    );

  const { data, error } = await client.auth.signInWithPassword(input.data);
  if (error !== null || data.user === null) {
    return adminFailureResponse(
      adminFailure("UNAUTHENTICATED", "Email or password is incorrect.", 401),
    );
  }
  const authorized = authorizeAdminMembership(
    await adminRepository.loadMembership(data.user.id),
    "admin.access",
  );
  if (!authorized.ok) {
    await client.auth.signOut();
    return adminFailureResponse(authorized.error);
  }
  return adminJson(
    { data: { displayName: authorized.data.displayName, role: authorized.data.role }, ok: true },
    200,
  );
}

export async function DELETE(request: NextRequest) {
  const gate = validateJsonMutationRequest(request);
  if (!gate.ok) return gate.response;
  const body = await request.json().catch(() => null);
  if (
    body === null ||
    typeof body !== "object" ||
    Array.isArray(body) ||
    Object.keys(body).length !== 0
  ) {
    return adminJson(
      { error: { code: "INVALID_REQUEST", message: "Invalid sign-out request." }, ok: false },
      400,
    );
  }
  const client = await createAdminAuthClient();
  if (client !== null) await client.auth.signOut();
  return adminJson({ data: { signedOut: true }, ok: true }, 200);
}