import { NextRequest, NextResponse } from "next/server"
import { requireAdmin } from "@/lib/api-auth"
import { accountAuthorizationService, businessService } from "@/lib/admin-authorization-service"
import { userService } from "@/lib/database"
import { auditLogService } from "@/lib/audit-log-service"

export const dynamic = "force-dynamic"

export async function GET(request: NextRequest) {
  const auth = await requireAdmin(request)
  if (auth.error) return auth.error

  const { searchParams } = new URL(request.url)
  const businessId = searchParams.get("business_id")
  const userId = searchParams.get("user_id")

  const filters: { business_id?: number; user_id?: number } = {}
  if (businessId != null && businessId !== "") {
    const n = parseInt(businessId, 10)
    if (!Number.isNaN(n)) filters.business_id = n
  }
  if (userId != null && userId !== "") {
    const n = parseInt(userId, 10)
    if (!Number.isNaN(n)) filters.user_id = n
  }

  try {
    const rows = await accountAuthorizationService.list(filters)
    const businessIds = [...new Set(rows.map((r) => r.business_id))]
    const userIds = [...new Set(rows.map((r) => r.user_id))]
    const adminIds = [...new Set(rows.map((r) => r.authorized_by_admin_id))]

    const [businesses, users, admins] = await Promise.all([
      businessIds.length
        ? Promise.all(businessIds.map((id) => businessService.getById(id)))
        : [],
      userIds.length
        ? Promise.all(userIds.map((id) => userService.getById(id)))
        : [],
      adminIds.length
        ? Promise.all(adminIds.map((id) => userService.getById(id)))
        : [],
    ])
    const businessMap = new Map(
      businesses.filter(Boolean).map((b) => [b!.business_id, { name: b!.name, slug: b!.slug }])
    )
    const userMap = new Map(
      users.filter(Boolean).map((u) => [u!.user_id, { user_name: u!.user_name, email: u!.email }])
    )
    const adminMap = new Map(
      admins.filter(Boolean).map((u) => [u!.user_id, { user_name: u!.user_name, email: u!.email }])
    )

    const list = rows.map((r) => ({
      ...r,
      business_name: businessMap.get(r.business_id)?.name ?? null,
      business_slug: businessMap.get(r.business_id)?.slug ?? null,
      user_name: userMap.get(r.user_id)?.user_name ?? null,
      user_email: userMap.get(r.user_id)?.email ?? null,
      authorized_by_name: adminMap.get(r.authorized_by_admin_id)?.user_name ?? null,
      authorized_by_email: adminMap.get(r.authorized_by_admin_id)?.email ?? null,
    }))

    return NextResponse.json(list)
  } catch (e) {
    console.error("GET /api/admin/authorizations:", e)
    return NextResponse.json(
      { error: e instanceof Error ? e.message : "Failed to list authorizations" },
      { status: 500 }
    )
  }
}

export async function POST(request: NextRequest) {
  const auth = await requireAdmin(request)
  if (auth.error) return auth.error

  try {
    const body = await request.json()
    const { business_id, user_id, account_identifier, notes } = body

    if (business_id == null || user_id == null) {
      return NextResponse.json(
        { error: "business_id and user_id are required" },
        { status: 400 }
      )
    }

    const row = await accountAuthorizationService.add({
      business_id: Number(business_id),
      user_id: Number(user_id),
      authorized_by_admin_id: auth.profile.user_id,
      account_identifier: account_identifier ?? null,
      notes: notes ?? null,
    })

    await auditLogService.log({
      adminUserId: auth.profile.user_id,
      action: "authorization_granted",
      targetType: "account_authorization",
      targetId: row.id,
      targetName: `user ${row.user_id} → business ${row.business_id}`,
      details: { business_id: row.business_id, user_id: row.user_id },
    })

    return NextResponse.json(row)
  } catch (e) {
    console.error("POST /api/admin/authorizations:", e)
    return NextResponse.json(
      { error: e instanceof Error ? e.message : "Failed to add authorization" },
      { status: 500 }
    )
  }
}