import "server-only";
import {
  ADMIN_ROLE_CAPABILITIES,
  adminCapabilitySchema,
  adminRoleHasCapability,
  type AdminCapability,
} from "@salixcommerce/core";
import { adminAuthConfigured, adminRepository } from "./admin";
import { createAdminAuthClient } from "./supabase-session";
import {
  adminFailure,
  type AdminContext,
  type AdminMembership,
  type AdminResult,
} from "./repository";

const userIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;

export function authorizeAdminMembership(
  membership: AdminMembership | null,
  capability: AdminCapability,
): AdminResult<AdminContext> {
  const parsedCapability = adminCapabilitySchema.parse(capability);
  if (membership === null || !membership.active) {
    return {
      error: adminFailure("FORBIDDEN", "This account is not an active administrator.", 403),
      ok: false,
    };
  }
  if (!adminRoleHasCapability(membership.role, parsedCapability)) {
    return {
      error: adminFailure("FORBIDDEN", "Your role cannot perform this operation.", 403),
      ok: false,
    };
  }
  return {
    data: {
      ...membership,
      capabilities: ADMIN_ROLE_CAPABILITIES[membership.role],
    },
    ok: true,
  };
}

export async function requireAdmin(
  capability: AdminCapability,
): Promise<AdminResult<AdminContext>> {
  if (!adminAuthConfigured) {
    return {
      error: adminFailure("ADMIN_UNAVAILABLE", "Administration is not configured.", 503),
      ok: false,
    };
  }
  const client = await createAdminAuthClient();
  if (client === null) {
    return {
      error: adminFailure("ADMIN_UNAVAILABLE", "Administration is not configured.", 503),
      ok: false,
    };
  }
  const { data, error } = await client.auth.getClaims();
  const userId = data?.claims.sub;
  if (error !== null || typeof userId !== "string" || !userIdPattern.test(userId)) {
    return {
      error: adminFailure("UNAUTHENTICATED", "Administrator sign-in is required.", 401),
      ok: false,
    };
  }
  try {
    return authorizeAdminMembership(await adminRepository.loadMembership(userId), capability);
  } catch {
    return {
      error: adminFailure("ADMIN_UNAVAILABLE", "Administrator authorization is unavailable.", 503),
      ok: false,
    };
  }
}