import { NextRequest, NextResponse } from "next/server";
import { requireAuth, getClientMetadata } from "@/lib/admin/auth";
import { db } from "@/lib/admin/db";

export const dynamic = "force-dynamic";

export async function POST(req: NextRequest) {
  try {
    const ctx = await requireAuth(req);

    const body = await req.json().catch(() => ({}));
    const { id, publicKey, transports } = body;

    if (!id || typeof id !== "string") {
      return NextResponse.json({ error: "Invalid credential ID" }, { status: 400 });
    }

    const credential = {
      id,
      publicKey: typeof publicKey === "string" ? publicKey : id,
      counter: 0,
      transports: Array.isArray(transports) ? transports : ["internal"],
      createdAt: new Date().toISOString(),
    };

    await db.addWebAuthnCredential(ctx.user.id, credential);

    const { ip, location } = getClientMetadata(req);
    await db.logSecurityEvent({
      actorId: ctx.user.id,
      actorName: ctx.user.name,
      actorEmail: ctx.user.email,
      actorLevel: ctx.user.level,
      targetUserId: ctx.user.id,
      targetUserEmail: ctx.user.email,
      targetUserName: ctx.user.name,
      action: "WEBAUTHN_REGISTERED",
      details: { credentialId: id.slice(0, 10) + "..." },
      ipAddress: ip,
      location,
    });

    return NextResponse.json({ success: true, message: "Passkey credential enrolled." });
  } catch (err: any) {
    console.error("[POST /api/admin/auth/webauthn/register] Error:", err);
    return NextResponse.json(
      { error: err.message || "Failed to register passkey." },
      { status: err.status || 500 }
    );
  }
}

export async function DELETE(req: NextRequest) {
  try {
    const ctx = await requireAuth(req);

    await db.clearWebAuthnCredentials(ctx.user.id);

    const { ip, location } = getClientMetadata(req);
    await db.logSecurityEvent({
      actorId: ctx.user.id,
      actorName: ctx.user.name,
      actorEmail: ctx.user.email,
      actorLevel: ctx.user.level,
      targetUserId: ctx.user.id,
      targetUserEmail: ctx.user.email,
      targetUserName: ctx.user.name,
      action: "WEBAUTHN_REMOVED",
      details: {},
      ipAddress: ip,
      location,
    });

    return NextResponse.json({ success: true, message: "All enrolled passkeys removed." });
  } catch (err: any) {
    console.error("[DELETE /api/admin/auth/webauthn/register] Error:", err);
    return NextResponse.json(
      { error: err.message || "Failed to remove passkeys." },
      { status: err.status || 500 }
    );
  }
}